Acer NitroSense EUVD-2026-32700

Attacker must have an interactive or remote authenticated session on an Acer device with NitroSense installed at a version below 3.01.3052 and with the PSAdminAgent service running (the default state on Nitro laptops). The exploitation primitive is limited to arbitrary file deletion under SYSTEM - not direct code execution - so weaponization for full SYSTEM shell typically requires chaining with a separate technique (e.g., the well-known 'arbitrary file delete to SYSTEM' chain abusing Windows Installer rollback or symlinks). Exploitation does not require admin rights, UAC bypass, or user interaction, but is constrained to local attackers; it cannot be triggered remotely over the network.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) describes a low-complexity local attack requiring only low privileges and no user interaction, with high impact on confidentiality, integrity, and availability of the vulnerable system - yielding a base score of 8.5. EPSS and CISA KEV data were not provided, so external exploitation telemetry cannot be cross-referenced; absence of KEV listing combined with no public exploit identified suggests this is not currently mass-exploited. Realistic risk is moderate-to-high for fleets of Acer Nitro laptops in managed environments where local users should not have SYSTEM-level destructive capability, but is bounded by the local-only attack vector - an attacker must already have authenticated code execution on the device, so this is a post-compromise escalation primitive (e.g., for malware persistence destruction, EDR tampering by deleting agent files, or denial-of-service against the OS) rather than a remote entry point.

A low-privileged local user (or malware running in a standard user context after phishing-based initial access) opens a handle to the PSAdminAgent Named Pipe, sends a crafted file-deletion command with a traversal path such as a Defender signature file or EDR driver, and the service deletes the target under SYSTEM. This is commonly chained as a post-exploitation step to disable security tooling or destroy forensic artifacts; no public exploit has been identified at time of analysis but the bug class is straightforward to weaponize.