Alienware Command Center CVE-2026-32655

The attacker must have local interactive access to the target Windows system and hold a low-privileged (non-administrative) account, as specified by AV:L and PR:L in the CVSS vector. AWCC versions prior to 6.13.8.0 must be installed and running on Alienware hardware - systems without AWCC or running 6.13.8.0 and above are not affected. Attack complexity is rated High (AC:H), indicating that exploitation is not straightforward and requires navigating specific conditions - likely a race condition, a particular AWCC service state, or a specific feature being active - that are not trivially reproducible. Remote attackers without local access cannot exploit this vulnerability. The scope is unchanged (S:U), so successful exploitation does not extend privileges beyond the local host.

The risk signals are broadly consistent and point to a moderate, non-urgent priority. CVSS 5.3 with AV:L/AC:H reflects that exploitation is local-only and requires elevated attack complexity - an attacker cannot reach this remotely and must navigate specific conditions. EPSS at 0.01% (0th percentile) indicates near-zero observed exploitation probability in the wild, reinforcing the SSVC finding of 'exploitation: none.' The SSVC 'automatable: no' rating further confirms this cannot be mass-exploited. Technical impact is rated 'partial,' consistent with S:U (unchanged scope) limiting blast radius to the compromised host. There is no CISA KEV listing and no public POC identified. The primary realistic risk is an insider or malware scenario where an already-local low-privileged actor seeks to escalate on an Alienware gaming system - not a critical enterprise attack path. The 'Information Disclosure' tag in the intelligence source appears mislabeled relative to the CVSS vector and CWE; security teams should not treat this as a data-exfiltration risk without vendor clarification.

A local low-privileged user on an Alienware system running AWCC prior to 6.13.8.0 identifies a privileged AWCC component - such as a service, named pipe, or registry key - accessible without elevated rights. Under specific, complex conditions (AC:H), the attacker interacts with this component to trigger a privileged operation, escalating their effective permissions on the local system. No public exploit code has been identified, so this scenario would currently require independent discovery of the exploitation path.