26
CVEs
2
Critical
10
High
0
KEV
0
PoC
12
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
10
MEDIUM
13
LOW
1
Monthly CVE Trend
Affected Products (30)
Asmb8 Ikvm Firmware
19
Z10Pe D16 Ws Firmware
18
Rt Ac86U Firmware
18
Z10Pr D16 Firmware
18
E700 G4 Firmware
17
Rs720A E9 Rs12V2 Firmware
17
Rs700A E9 Rs4 Firmware
17
Rs500A E10 Rs4 Firmware
17
Rs700 E9 Rs12 Firmware
17
Rs500 E9 Rs4 Firmware
17
Z11Pa D8 Firmware
17
Ws X299 Pro Se Firmware
17
Rs500A E9 Rs4 Firmware
17
Z11Pa D8C Firmware
17
Esc4000 G4X Firmware
17
Rs720Q E9 Rs8 Firmware
17
Rs720 E9 Rs24 U Firmware
17
Rs520 E9 Rs8 Firmware
17
Rs520 E9 Rs12 E Firmware
17
Esc4000 Dhd G4 Firmware
17
Rs720A E9 Rs24V2 Firmware
17
Rs720A E9 Rs24 E Firmware
17
Rs720 E9 Rs8 G Firmware
17
Rs100 E10 Pi2 Firmware
17
Knpa U16 Firmware
17
Esc4000 G4 Firmware
17
Z11Pa U12 Firmware
17
Rs500 E9 Ps4 Firmware
17
Rs500A E9 Rs4 U Firmware
17
Ws C422 Pro Se Firmware
17
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75754 | Unauthenticated remote root compromise of ASUS Control Center (Enterprise/ACC) is possible by chaining a missing-authentication flaw, an SSRF, and hard-coded credentials: an attacker retrieves the product's encryption key over a plain HTTP request, which causes a local service to enable SSH on port 2222, then logs in with built-in credentials to gain a root shell. From that shell an attacker can read, write, and delete all ACC data and remotely control every managed server, PC, and workstation in the environment. ASUS assigns CVSS 4.0 base 10.0; no public exploit identified at time of analysis. | CRITICAL | 10.0 | 0.2% | 50 |
No patch
|
| CVE-2026-13385 | Remote command execution in certain ASUS router firmware allows a network man-in-the-middle attacker to force the router to download and run arbitrary commands from a spoofed update/download server. The root cause is a failure to validate both the integrity check value (CWE-354) and the TLS server certificate, so an attacker positioned in the network path can impersonate a legitimate ASUS server. No public exploit identified at time of analysis and the flaw is not in CISA KEV; ASUS self-reported it and rates it critical (CVSS 4.0 9.5), though exploitation requires the attacker to first achieve a MITM position (AT:P). | CRITICAL | 9.5 | 0.1% | 48 |
No patch
|
| CVE-2026-8921 | Local privilege escalation to SYSTEM in ASUS Business Manager lets a low-privileged local user run arbitrary code by tampering with an inter-process communication (IPC) message that the software's privileged service trusts. Because the SYSTEM-level component controls a file name or path based on attacker-influenced IPC input (CWE-73), a standard user can coerce it into loading or executing attacker-chosen content. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV; ASUS is the reporter and has issued a security advisory. | HIGH | 8.5 | 0.1% | 43 |
No patch
|
| CVE-2022-4989 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memory regions via crafted IOCTL requests,. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 8.5 | 0.1% | 43 |
No patch
|
| CVE-2026-8920 | Arbitrary file operations in ASUS Aura Wallpaper Service allow a low-privileged local user to send crafted commands that carry an attacker-controlled file path, bypassing the service's intended path restrictions and abusing its higher-privileged context. Because the service exposes a communication channel that fails to properly restrict callers or validate file names (CWE-923), a local user can read, write, or manipulate files outside the intended scope, with high impact to confidentiality, integrity, and availability; on certain ASUS models exploitation can also render a single feature unavailable. No public exploit is identified at time of analysis, and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.5 (High) reflects meaningful impact despite the local vector and high attack complexity. | HIGH | 8.5 | 0.1% | 42 |
No patch
|
| CVE-2026-8917 | Privilege escalation via untrusted pointer dereference in ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll exposes local attackers to arbitrary kernel memory writes through vulnerable IOCTL handlers in the associated kernel-mode drivers. The flaw (CWE-822) permits a caller supplying an attacker-controlled pointer to force the driver to write a specific value to an arbitrary memory address, enabling elevation of privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the high CVSS 4.0 score of 8.4 and confirmed arbitrary-write primitive make this a meaningful local privilege escalation risk on affected systems. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-15029 | Arbitrary physical memory read/write in the ASUS System Control Interface (v3 and legacy) and ASUS Business Manager driver allows a local administrator to issue crafted IOCTL requests that bypass OS-enforced memory protections, per an ASUS-published advisory. The flaw (CWE-822, Untrusted Pointer Dereference) turns the signed ASUS driver into a read/write primitive over physical memory, enabling privilege escalation from admin to kernel and potential defense evasion. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-13585 | Local information disclosure and denial of service in the ASUS System Control Interface driver (v3 and earlier) and ASUS Business Manager lets a user already holding local administrator rights issue crafted IOCTL requests to read leftover sensitive data from kernel/driver buffers and, in severe cases, exhaust unthrottled resources to crash the host. The flaw stems from missing resource limits (CWE-770) combined with reuse of memory that still contains prior sensitive contents. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; ASUS self-reported and issued an advisory. | HIGH | 8.2 | 0.1% | 41 |
No patch
|
| CVE-2026-19397 | Unauthenticated adjacent-network host takeover in ASUS Control Center Express Agent exposes critical management functions without any authentication check (CWE-306), allowing any attacker with network adjacency to directly connect to the agent and fully control the host. The attack is contingent on the host having an active login session at the time of exploitation. No public exploit code has been identified at time of analysis, but the unauthenticated nature and high CIA impact make this a meaningful risk in environments where ASUS Control Center is deployed across managed workstations or servers. | HIGH | 7.7 | 0.2% | 38 |
No patch
|
| CVE-2022-4990 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validation and access restricted memory blocks. Rated high severity (CVSS 7.3). No vendor patch available. | HIGH | 7.3 | 0.1% | 37 |
No patch
|
| CVE-2026-8919 | Credential theft in ASUS GameSDK allows a remote attacker to capture a local user's NTLM hash by luring them to a crafted web page that abuses a permissive cross-domain policy to send a UNC-path request to GameSDK's local service endpoint. The flaw affects systems running the ASUS GameSDK local service (bundled with ASUS gaming utilities) and requires the victim to visit an attacker-controlled page (UI required); no authentication is needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the leaked NTLM material can be relayed or cracked to reach other services. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-8918 | Local privilege abuse in ASUS Armoury Crate (versions up to and including 6.4.12) allows a local administrator to bypass input validation and perform arbitrary kernel memory read/write or trigger a system crash (BSOD). The flaw is reported by ASUS and tracked as EUVD-2026-38205; no public exploit identified at time of analysis. CVSS 4.0 base score is 7.1 with high attack complexity and high privileges required, reflecting that exploitation needs an existing administrative foothold. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-19398 | Out-of-bounds write in the SmiFlash SMM (System Management Mode) module affects ASUS FA507NU and FA507NV laptop BIOS firmware across all versions. A local administrator can dispatch a crafted Software SMI (SW SMI) request with an oversized length value, causing the SmiFlash handler to write beyond its allocated SMRAM buffer boundary, resulting in a system crash (BSOD) or irreversible BIOS flash corruption. The affected models are designated 'unsupported-when-assigned,' meaning these products were already outside active vendor support when this CVE was issued; no public exploit has been identified at time of analysis. | MEDIUM | 6.8 | 0.1% | 34 |
No patch
|
| CVE-2026-12960 | Improper export of Android application components in the ASUS Router App enables any co-installed third-party application on the same Android device to send a crafted Intent that forces the ASUS Router App to navigate to an attacker-specified URL. The flaw, classified as CWE-926, allows an attacker-controlled application to abuse the exposed component as an open redirect, potentially rendering phishing content or harvesting router management credentials within the app's trusted interface context. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. | MEDIUM | 6.0 | 0.1% | 30 |
No patch
|
| CVE-2026-16004 | Arbitrary PCI/PCIe configuration space read and write access through the ASUS Armoury Crate kernel driver exposes a local low-privileged user to hardware-level integrity and availability risks by bypassing the driver's IOCTL verification logic. All tracked versions of Armoury Crate are affected (CPE wildcard), meaning any Windows-based ASUS gaming system with the software installed is in scope. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects the constrained local/high-complexity exploitation model. | MEDIUM | 5.9 | 0.1% | 30 |
No patch
|