Which versions of Planet9 are affected by CVE-2026-50602?

Acer's Planet9 software contains a local privilege escalation vulnerability (CVE-2026-50602, CVSS 8.5) allowing authenticated local users to achieve full SYSTEM-level control, creating a critical…

How to fix or mitigate CVE-2026-50602?

Within 24 hours, inventory all systems running Acer Planet9 and assess whether the software can be disabled without operational impact; restrict local system access to administrators only. Over the next 7 days, audit and correct file ACLs on the Planet9 service executable to remove write permissions for non-administrative users; implement host-based file integrity monitoring to detect binary replacement attempts; and enforce principle of least privilege across all local user accounts. Within 30 days, escalate to Acer support for patch timeline and alternative solutions; evaluate permanent decommission or upgrade options; and establish monthly advisory monitoring until a vendor patch is released.

Planet9 CVE-2026-50602

Q: What is the CVSS score of CVE-2026-50602?

CVE-2026-50602 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-60027 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-08-17 Acer

GHSA-63xg-4wvg-w9xp

RCE Planet9 Background Service Acer

8.5

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Local vector confirmed; PR:L for required authenticated account; S:C because privilege escalation crosses from user to SYSTEM security boundary.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Acer).

CVSS VectorVendor: Acer

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 02:46 vuln.today

CVE Published

Aug 17, 2026 - 02:16 cve.org

HIGH 8.5

DescriptionCVE.org

A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background service. The service runs with SYSTEM privileges, while the affected executable grants excessive permissions to non-administrative users. As a result, an authenticated local user could potentially modify or replace the executable and execute arbitrary code with SYSTEM privileges when the service starts or the system is restarted.

AnalysisAI

Local privilege escalation in Acer's Planet9 software allows an authenticated local user to achieve arbitrary code execution with SYSTEM privileges by exploiting overly permissive file ACLs on the Planet9 background service executable. The service runs as SYSTEM but the executable it invokes grants write access to non-administrative users, enabling binary replacement. When the service restarts or the host reboots, the attacker-controlled payload executes with full SYSTEM authority. No public exploit has been identified at time of analysis, and this is not listed in the CISA KEV catalog.

Technical ContextAI

Planet9 is an Acer platform (CPE: cpe:2.3:a:acer:planet9_background_service:*:*:*:*:*:*:*:*), likely a system utility or gaming companion suite installed on Acer consumer and gaming hardware running Windows. The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource): a Windows service configured to run under the SYSTEM account references an executable whose filesystem ACL grants write or modify rights to unprivileged users. This violates the Windows security model principle that service binaries must be writable only by administrators. When the SCM (Service Control Manager) launches the service, it executes whichever binary currently occupies that path - with no additional integrity check - meaning a replaced binary runs at the same SYSTEM trust level. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L confirms local access with low attack complexity and no special attack requirements beyond a standard user account.

RemediationAI

The primary fix is to apply the patched version of Planet9 as detailed in the Acer advisory at https://community.acer.com/en/kb/articles/19870; an exact patched version number was not published in the available data, so administrators should consult that advisory directly. Until a patch is applied, a concrete compensating control is to manually correct the ACL on the Planet9 service executable using icacls to remove write and modify permissions for non-administrative users (e.g., icacls "<path_to_executable>" /remove:g Users:(W,M)), then verify using sc qc to confirm the service binary path. A secondary control is to enable Windows Defender Application Control (WDAC) or Software Restriction Policies to block execution of unsigned or untrusted binaries from the service path, though this requires careful policy authoring to avoid disrupting legitimate operation. Restricting local user account provisioning on Acer endpoints and monitoring for unexpected file modification events on Windows service executable paths via Sysmon EventID 11 provides additional detection coverage.