EUVD-2026-41483
GHSA-2844-p28c-wcj6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as local low-priv user
-
DeliveryLocate ASUS Business Manager IPC endpoint
-
ExploitCraft tampered IPC message with controlled path
-
ExecutionSYSTEM service acts on attacker path
-
PersistExecute arbitrary code as SYSTEM
-
ImpactFull host compromise via privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
|
| Exploitation Conditions | Exploitation requires an attacker to already hold a low-privileged authenticated local account on the Windows host running ASUS Business Manager (PR:L, AV:L) and the ability to send or tamper with a message on the application's local IPC channel to the privileged service. The specific prerequisite named in the description is the crafting of a 'tampered IPC message' whose file-name/path field is honored by the SYSTEM-level component. Limiting factors: it cannot be triggered remotely or by an unauthenticated attacker, requires no victim user interaction, and depends on ASUS Business Manager being installed with its privileged service running; the exact vulnerable versions are not specified in the available data. |
| Impact | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N) describes a local, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality, integrity, and availability impact on the vulnerable system but no subsequent-system (scope) change - a classic local privilege escalation to SYSTEM rather than remote compromise. The 8.5 (High) score is driven by SYSTEM-level impact, not remote reachability: the attacker must already hold an authenticated local account, which meaningfully limits mass exploitation. No EPSS score, KEV listing, or public POC is provided, so there is no evidence of active or automatable exploitation - this reads as a genuine post-compromise escalation primitive, not an internet-facing emergency. Risk is elevated on multi-user or shared workstations where untrusted local users exist and lower on single-admin machines. Data gap to note: exact affected and fixed versions are not enumerated in the input (only a wildcard CPE and a generic advisory URL), so scope must be confirmed against the vendor advisory. |
| Exploit ScenarioDerived | A logged-in standard user on a corporate laptop running ASUS Business Manager crafts or replays a malicious IPC message to the SYSTEM-level service, supplying an attacker-controlled file path. The privileged service acts on that path and executes attacker-chosen code, giving the user full SYSTEM privileges on the host. No public exploit is currently identified, but the local, low-complexity nature (AV:L/AC:L) means a working PoC would likely be reliable once developed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 03, 2026
Local privilege escalation to SYSTEM in ASUS Business Manager lets a low-privileged local user run arbitrary code by tampering with an inter-process communication (IPC) message that the software's privileged service trusts. Because the SYSTEM-level component controls a file name or path based on attacker-influenced IPC input (CWE-73), a standard user can coerce it into loading or executing attacker-chosen content. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV; ASUS is the reporter and has issued a security advisory.
RemediationAI
Update ASUS Business Manager to the fixed release listed under the 'Security Update for ASUS Business Manager' section of the ASUS Security Advisory (https://www.asus.com/security-advisory); the input does not include an exact fixed version, so obtain it directly from that advisory rather than assuming a build (No vendor-released fixed version independently confirmed from available data). Because exploitation requires an authenticated local user, effective interim compensating controls are to restrict interactive and local logon rights on affected machines to trusted administrators only, remove non-essential standard-user accounts from shared endpoints, and - if the software is not business-critical - stop and disable the privileged ASUS Business Manager service until patched, accepting loss of its management functionality as the trade-off. Monitoring the local IPC endpoint and the service's file-access activity with EDR can help detect tampering attempts in the interim.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ASUS Business Manager is a Windows endpoint management/utility suite that ships a privileged background service running as SYSTEM and communicating with a lower-privileged client over a local IPC channel (named pipe, local socket, or similar). The root cause is CWE-73 (External Control of File Name or Path): the privileged endpoint derives a file name or path from data received in an IPC message without adequately validating the sender or constraining the path to a safe location. An attacker who crafts or replays a tampered IPC message therefore dictates which file the SYSTEM process opens, writes, or executes, yielding code execution in the service's security context. The single affected CPE is cpe:2.3:a:asus:asus_business_manager:*:*:*:*:*:*:*:* - a locally installed Windows application, not a network service.
Know when Asus Business Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local authenticated low-priv user (AV:L/PR:L) sends a low-complexity tampered IPC message (AC:L) to gain SYSTEM, yielding full C/I/A impact with no scope change.
Primary rating from Vendor (ASUS).
CVSS VectorVendor: ASUS
DescriptionCVE.org
External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. Refer to the ' Security Update for ASUS Business Manager ' section on the ASUS Security Advisory for more information.
Zero Day Initiative Advisories
Executive ViewAI
ASUS Business Manager contains a local privilege escalation vulnerability (CVE-2026-8921, CVSS 8.5) allowing standard system users to gain SYSTEM-level access through inter-process communication message tampering. While no public exploit identified at time of analysis, the vulnerability poses significant risk to organizations where untrusted users may access systems, as successful exploitation enables full system compromise. Immediate inventory and interim mitigations are required pending vendor patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local user account creation and standard user privilege escalation where operationally feasible; (2) Monitor inter-process communication patterns for suspicious activity; (3) Disable ASUS Business Manager if not operationally critical; (4) Implement application whitelisting and code execution controls to prevent arbitrary payload loading.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB