ASUSTOR ABP/AES CVE-2026-18759

Exploitation requires an authenticated local or domain user account with an interactive or remote desktop session on the Windows host where ASUSTOR ABP or AES is installed and the background service is actively running. The attacker must be able to read the IPC key file - which is accessible to standard users by default filesystem ACL - and call the Windows DPAPI CryptUnprotectData function within their own user session context to unwrap the key; both are available to any authenticated local user without elevated rights. No special group membership (e.g., local Administrators, Backup Operators), non-default product configuration, or specific OS version beyond a standard Windows install is required. Exploitation is strictly local (AV:L): remote unauthenticated attackers cannot reach the file-based IPC channel over the network. No privileged user interaction is needed. Exploitation is bounded to systems where ABP or AES is installed; systems not running these ASUSTOR products are unaffected.

The CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N accurately represents the threat profile. Attack complexity is genuinely low - no race conditions, no heap grooming, no special timing required; only reading a file and invoking a standard Windows API. The PR:L metric reflects that a local authenticated account is the sole prerequisite. The full C/H/I:H triad means an attacker achieves complete control of the local filesystem as SYSTEM, enabling credential theft, backdoor installation, or security tool tampering. This CVE does not appear in the CISA KEV catalog, and no public POC has been disclosed, keeping immediate widespread risk lower. However, the attack path is straightforward enough that a motivated insider or malware process with local user-level access could exploit it with minimal tooling. Risk is highest on shared Windows hosts - backup servers, endpoint management systems, or NAS-adjacent workstations - where ASUSTOR agents are deployed alongside untrusted local user accounts. No EPSS data was available in the provided intelligence; the absence of KEV listing and POC suggests targeted rather than widespread exploitation is the current threat model.

A low-privileged domain or local user logged into a Windows workstation with ASUSTOR ABP or AES installed calls the Windows DPAPI to decrypt the IPC encryption key stored in a standard-user-readable file, then constructs a forged AES-encrypted IPC request embedding a directory traversal payload such as '..\..\Windows\System32\config\SAM' as the destination path. The background service, running as NT AUTHORITY\SYSTEM, processes the request without checking the caller's identity, reads or writes the targeted file at SYSTEM privilege, and the attacker extracts the SAM database or drops a new SYSTEM-owned binary, achieving full local privilege escalation. No public POC has been identified, but the exploit path requires only standard Windows API calls and file I/O.