Which versions of ASUSTOR ABP/AES are affected by EUVD-2026-52640?

ASUSTOR Backup Plan and EZSync services are vulnerable to local privilege escalation, enabling any user with local system access to execute arbitrary operations with SYSTEM-level permissions.

How to fix or mitigate EUVD-2026-52640?

Within 24 hours, inventory all systems running ASUSTOR Backup Plan or EZSync and identify which user accounts have local logon privileges. Within 7 days, implement Windows Group Policy to deny local interactive logon for non-administrative accounts, disable the vulnerable ASUSTOR services if not actively used for backup operations, and document these systems in your vulnerability tracking system. Within 30 days, configure Windows Event Log monitoring for failed privilege escalation attempts, establish a dashboard to track ASUSTOR for vendor patches, and test your monitoring to ensure exploitation attempts are detected.

ASUSTOR ABP/AES EUVD-2026-52640

Q: What is the CVSS score of EUVD-2026-52640?

EUVD-2026-52640 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-18759 HIGH

Improper Authentication (CWE-287)

2026-08-04 ASUSTOR1

GHSA-2p27-7hcf-mpp3

Authentication Bypass Privilege Escalation Path Traversal Abp And Aes Asustor Inc

8.5

CVSS 4.0 · Vendor: ASUSTOR1

Severity by source

Vendor (ASUSTOR1) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local attack requiring only a standard authenticated account (PR:L); no scope change since SYSTEM-level impact is confined to the local host.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ASUSTOR1).

CVSS VectorVendor: ASUSTOR1

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 08:02 vuln.today

CVE Published

Aug 04, 2026 - 07:25 cve.org

HIGH 8.5

DescriptionCVE.org

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the key and forge valid IPC requests. Furthermore, the service does not check the identity of the requesting process and validates destination paths using an insufficient substring check. A local attacker can submit crafted encrypted requests containing directory traversal sequences to perform arbitrary file reads and arbitrary file writes as NT AUTHORITY\SYSTEM, leading to full local privilege escalation. Affected products and versions include: ABP (ASUSTOR Backup Plan) 2.0.7.10171 and earlier as well as AES (ASUSTOR EZSync) 1.1.1.3113 and earlier.

AnalysisAI

ASUSTOR Backup Plan (ABP) and EZSync (AES) background services run as NT AUTHORITY\SYSTEM and expose a file-based IPC channel whose AES encryption key is readable by standard users and recoverable via Windows DPAPI, allowing any authenticated local account to forge valid service requests. The services further fail to verify the identity of the requesting process and validate filesystem paths using an insufficient substring check, enabling directory traversal sequences to bypass path restrictions. A local attacker can chain these weaknesses to perform arbitrary file reads and writes as SYSTEM, achieving full local privilege escalation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

Both affected products - ASUSTOR Backup Plan (ABP) 2.0.7.10171 and earlier, and ASUSTOR EZSync (AES) 1.1.1.3113 and earlier, identified under CPE cpe:2.3:a:asustor_inc.:abp_and_aes - operate Windows background services under the NT AUTHORITY\SYSTEM account and communicate with other processes through a file-based IPC mechanism. The IPC channel is encrypted with AES, but the encryption key material is stored in a file with ACLs permitting read access by standard users. That key file is additionally protected by Windows DPAPI (Data Protection API), which binds the secret to the current user session - meaning any local authenticated user can call the DPAPI to unwrap the key in their own context. CWE-287 (Improper Authentication) captures the root cause: the service authenticates the message (via the shared AES key) but not the caller, so possession of the key is the sole gatekeeper. A second weakness compounds this: path validation for destination files uses a substring check rather than canonicalized path comparison, making it bypassable with directory traversal sequences (e.g., '../../') that satisfy the substring filter while escaping the intended directory.

RemediationAI

Upgrade ASUSTOR Backup Plan (ABP) beyond version 2.0.7.10171 and ASUSTOR EZSync (AES) beyond version 1.1.1.3113 by consulting the vendor advisory at https://www.asustor.com/security/security_advisory_detail?id=70 for the specific fixed release numbers, which are not independently confirmed from available data. Where immediate patching is not feasible, restrict the set of local user accounts on systems running ABP or AES to only those strictly required, reducing the attack surface by limiting who can attempt key recovery. Disabling the ABP or AES background service entirely on hosts where backup or sync functionality is unnecessary is an effective compensating control, with the trade-off of losing that product's functionality. Hardening the filesystem ACLs on the IPC encryption key file to deny read access to standard user accounts would raise the exploitation barrier, though the exact file path must be sourced from the vendor or reverse engineering, and this approach may break legitimate product functionality.