EUVD-2026-81401
GHSA-4m99-cchc-mf8w
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local authenticated low-privileged user abuses a privileged pipe for registry writes yielding full host takeover, so AV:L/PR:L/S:U with C:H/I:H/A:H.
Primary rating from Vendor (Acer).
CVSS VectorVendor: Acer
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.
Articles & Coverage 2
AnalysisAI
Local privilege escalation in Acer System Monitoring, a component bundled with NitroSense and PredatorSense on Acer Nitro and Predator laptops, allows an authenticated local user to abuse a privileged Named Pipe service for unauthorized registry operations. Exploitation requires local access and the vulnerable service running, and the vendor rates the exploit as Unproven with no public exploit code identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an already-authenticated local user account on a Windows system running the Acer System Monitoring component, which is bundled with the NitroSense and PredatorSense utilities preinstalled on Acer Nitro and Predator laptops. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority local privilege-escalation flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fix version is provided in the input data; treat the vendor advisory at https://community.acer.com/en/kb/articles/19876 as the authoritative source and apply any Acer-released update for System Monitoring, NitroSense, and PredatorSense as soon as it becomes available, also checking OEM updates through Acer support channels. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, pull an inventory of all Acer Nitro and Predator laptops in the fleet and confirm which ones have NitroSense or PredatorSense (and therefore the Acer System Monitoring service) installed, capturing the component version on each; note that no vendor-released patch has been identified at time of analysis, so no version upgrade is currently available to close the issue. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Same weakness CWE-284 – Improper Access Control
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today