Which versions of ASUS GameSDK are affected by CVE-2026-8919?

ASUS GameSDK contains a credential theft vulnerability that allows attackers to steal NTLM hashes from users simply by luring them to a malicious webpage.

How to fix or mitigate CVE-2026-8919?

Within 24 hours, inventory systems running ASUS GameSDK and assess business criticality of the gaming utilities in your environment. Within 7 days, implement compensating controls: disable the GameSDK local service if not essential to business operations, restrict outbound SMB and NTLM relay on the network, and block public internet access from affected systems to malicious sites through gateway controls. Within 30 days, evaluate alternative gaming software that eliminates this attack surface, monitor ASUS security advisories for patch release, and conduct incident response drills for credential compromise scenarios in case of prior exploitation.

ASUS GameSDK CVE-2026-8919

Q: What is the CVSS score of CVE-2026-8919?

CVE-2026-8919 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44585 HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-07-15 ASUS

GHSA-hc66-xcg9-cfg4

Information Disclosure Cors Misconfiguration Gamesdk Asus

7.2

CVSS 4.0 · Vendor: ASUS

Severity by source

Vendor (ASUS) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Network-reachable local endpoint with no auth (PR:N) but mandatory victim page-visit (UI:R); partial hash disclosure and tampering (C:L/I:L) with GameSDK denial-of-service (A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N

Primary rating from Vendor (ASUS).

CVSS VectorVendor: ASUS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 02:30 vuln.today

CVE Published

Jul 15, 2026 - 02:00 cve.org

HIGH 7.2

DescriptionCVE.org

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in information disclosure or data tampering, may cause GameSDK to become unavailable, and may also enable access to the victim’s information on other services. Refer to the ' Security Update for ASUS GameSDK ' section on the ASUS Security Advisory for more information.

AnalysisAI

Credential theft in ASUS GameSDK allows a remote attacker to capture a local user's NTLM hash by luring them to a crafted web page that abuses a permissive cross-domain policy to send a UNC-path request to GameSDK's local service endpoint. The flaw affects systems running the ASUS GameSDK local service (bundled with ASUS gaming utilities) and requires the victim to visit an attacker-controlled page (UI required); no authentication is needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the leaked NTLM material can be relayed or cracked to reach other services.

Technical ContextAI

GameSDK runs a local HTTP service endpoint on the host to support ASUS gaming software integrations. The root cause is CWE-942 (Permissive Cross-Domain Policy with Untrusted Domains): the local endpoint accepts cross-origin requests from arbitrary/untrusted web origins instead of restricting them to a trusted allow-list. Because a browser page from any origin can reach the loopback service, a malicious page can instruct the service to process a Windows UNC path (\\attacker-host\share). Windows SMB/NTLM authentication then automatically sends the current user's NTLM challenge-response to the attacker-controlled host, exposing the hash. CPE cpe:2.3:a:asus:gamesdk:*:*:*:*:*:*:*:* indicates all versions prior to the fix are affected across ASUS GameSDK builds.

RemediationAI

Patch available per vendor advisory: update ASUS GameSDK to the fixed version described in the 'Security Update for ASUS GameSDK' section of the ASUS Security Advisory at https://www.asus.com/security-advisory/ (exact fixed version not included in the provided data - obtain it from the advisory rather than assuming a number). If immediate patching is not possible, compensating controls include uninstalling or stopping the GameSDK local service on hosts that do not need it (trade-off: breaks ASUS gaming software features that depend on it), and blocking outbound SMB (TCP 445 and 139) to the internet and untrusted networks at the host/perimeter firewall so leaked UNC/NTLM authentication cannot reach attacker hosts (trade-off: may affect legitimate remote file shares). Enforcing NTLM outgoing restrictions / SMB signing and educating users against opening untrusted links reduces both the hash-leak and relay risk.