Which versions of Aura Wallpaper Service are affected by CVE-2026-8920?

A high-severity privilege escalation vulnerability in ASUS Aura Wallpaper Service allows local users with low privileges to bypass file path restrictions and perform unauthorized file operations with…

How to fix or mitigate CVE-2026-8920?

Within 24 hours, identify and inventory all ASUS systems running Aura Wallpaper Service and document the scope of local user access. Within 7 days, disable the Wallpaper Service if not operationally critical, restrict local user privilege levels, and enable file integrity monitoring on sensitive system directories; coordinate with ASUS support to understand patch availability. Within 30 days, establish monitoring for any file system anomalies originating from the Wallpaper Service process and prepare an automated deployment plan for vendor patches as they become available.

Aura Wallpaper Service CVE-2026-8920

Q: What is the CVSS score of CVE-2026-8920?

CVE-2026-8920 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-44586 HIGH

Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)

2026-07-15 ASUS

GHSA-285c-cc6q-hwff

Authentication Bypass Aura Wallpaper Service Asus

8.5

CVSS 4.0 · Vendor: ASUS

Severity by source

Vendor (ASUS) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local IPC exploitation by an existing low-priv user gives AV:L/PR:L; the path-bypass makes AC:H; the privileged service acting on attacker files crosses a trust boundary (S:C) with full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N

Primary rating from Vendor (ASUS).

CVSS VectorVendor: ASUS

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 02:30 vuln.today

CVE Published

Jul 15, 2026 - 02:00 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On specific models , this can also cause a single feature to become unavailable . Refer to the ' Security Update for Aura Wallpaper Service ' section on the ASUS Security Advisory for more information.

AnalysisAI

Arbitrary file operations in ASUS Aura Wallpaper Service allow a low-privileged local user to send crafted commands that carry an attacker-controlled file path, bypassing the service's intended path restrictions and abusing its higher-privileged context. Because the service exposes a communication channel that fails to properly restrict callers or validate file names (CWE-923), a local user can read, write, or manipulate files outside the intended scope, with high impact to confidentiality, integrity, and availability; on certain ASUS models exploitation can also render a single feature unavailable. No public exploit is identified at time of analysis, and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.5 (High) reflects meaningful impact despite the local vector and high attack complexity.

Technical ContextAI

The affected component is the ASUS Aura Wallpaper Service, a Windows background service that ships as part of ASUS Aura ecosystem software on ASUS PCs and laptops to manage dynamic/lighting-integrated wallpaper features. The root cause is CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints), compounded by external control of file name or path (a path-traversal/injection class weakness). Local clients communicate with the privileged service over an IPC channel (such as a named pipe or local socket) that does not adequately authenticate or authorize the calling endpoint, and the service trusts a file path supplied inside the command without canonicalizing or confining it to an allowed directory. As a result the service performs file operations on behalf of the caller at a location the caller chooses, effectively lending its own privilege level to an unprivileged requester. The CPE cpe:2.3:a:asus:aura_wallpaper_service:*:*:*:*:*:*:*:* identifies the affected application but does not bound the fixed version.

RemediationAI

Apply ASUS's update for the Aura Wallpaper Service as described in the 'Security Update for Aura Wallpaper Service' section of the ASUS Security Advisory (https://www.asus.com/security-advisory/); the input does not include an exact fixed version, so treat patch status as 'Patch available per vendor advisory' and confirm the specific build number against the advisory before deploying. As compensating controls where immediate patching is not possible: uninstall or stop and disable the Aura Wallpaper Service if the dynamic wallpaper feature is not required (trade-off: loss of Aura wallpaper functionality); restrict local interactive/logon access on affected endpoints so untrusted low-privileged users cannot reach the local IPC channel (trade-off: does not help on single-user machines where the user is the threat); and monitor for anomalous file writes performed by the service process outside its expected wallpaper/config directories. Because exploitation requires local access, endpoint hardening and limiting who can log on locally meaningfully reduce exposure until the patch is applied.