33
CVEs
2
Critical
13
High
0
KEV
0
PoC
15
Unpatched C/H
3.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
13
MEDIUM
16
LOW
2
Monthly CVE Trend
Affected Products (30)
Asmb8 Ikvm Firmware
19
Z10Pe D16 Ws Firmware
18
Rt Ac86U Firmware
18
Z10Pr D16 Firmware
18
E700 G4 Firmware
17
Rs720A E9 Rs12V2 Firmware
17
Rs700A E9 Rs4 Firmware
17
Rs500A E10 Rs4 Firmware
17
Rs700 E9 Rs12 Firmware
17
Rs500 E9 Rs4 Firmware
17
Z11Pa D8 Firmware
17
Ws X299 Pro Se Firmware
17
Rs500A E9 Rs4 Firmware
17
Z11Pa D8C Firmware
17
Esc4000 G4X Firmware
17
Rs720Q E9 Rs8 Firmware
17
Rs720 E9 Rs24 U Firmware
17
Rs520 E9 Rs8 Firmware
17
Rs520 E9 Rs12 E Firmware
17
Esc4000 Dhd G4 Firmware
17
Rs720A E9 Rs24V2 Firmware
17
Rs720A E9 Rs24 E Firmware
17
Rs720 E9 Rs8 G Firmware
17
Rs100 E10 Pi2 Firmware
17
Knpa U16 Firmware
17
Esc4000 G4 Firmware
17
Z11Pa U12 Firmware
17
Rs500 E9 Ps4 Firmware
17
Rs500A E9 Rs4 U Firmware
17
Ws C422 Pro Se Firmware
17
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75754 | Unauthenticated remote root compromise of ASUS Control Center (Enterprise/ACC) is possible by chaining a missing-authentication flaw, an SSRF, and hard-coded credentials: an attacker retrieves the product's encryption key over a plain HTTP request, which causes a local service to enable SSH on port 2222, then logs in with built-in credentials to gain a root shell. From that shell an attacker can read, write, and delete all ACC data and remotely control every managed server, PC, and workstation in the environment. ASUS assigns CVSS 4.0 base 10.0; no public exploit identified at time of analysis. | CRITICAL | 10.0 | 0.2% | 50 |
No patch
|
| CVE-2026-13385 | Remote command execution in certain ASUS router firmware allows a network man-in-the-middle attacker to force the router to download and run arbitrary commands from a spoofed update/download server. The root cause is a failure to validate both the integrity check value (CWE-354) and the TLS server certificate, so an attacker positioned in the network path can impersonate a legitimate ASUS server. No public exploit identified at time of analysis and the flaw is not in CISA KEV; ASUS self-reported it and rates it critical (CVSS 4.0 9.5), though exploitation requires the attacker to first achieve a MITM position (AT:P). | CRITICAL | 9.5 | 0.1% | 48 |
No patch
|
| CVE-2026-8921 | Local privilege escalation to SYSTEM in ASUS Business Manager lets a low-privileged local user run arbitrary code by tampering with an inter-process communication (IPC) message that the software's privileged service trusts. Because the SYSTEM-level component controls a file name or path based on attacker-influenced IPC input (CWE-73), a standard user can coerce it into loading or executing attacker-chosen content. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV; ASUS is the reporter and has issued a security advisory. | HIGH | 8.5 | 0.1% | 43 |
No patch
|
| CVE-2022-4989 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memory regions via crafted IOCTL requests,. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 8.5 | 0.1% | 43 |
No patch
|
| CVE-2025-15101 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the Web management interface of ASUS router models that allows an unauthenticated attacker to perform actions with the privileges of an authenticated administrator, potentially including arbitrary system command execution. The vulnerability affects ASUS router products across multiple versions due to insufficient CSRF token validation in the web interface. While no CVSS score or EPSS data is currently available, the ability to execute system commands on a network-critical device represents a critical severity threat. | HIGH | 8.5 | 0.0% | 43 |
No patch
|
| CVE-2026-8920 | Arbitrary file operations in ASUS Aura Wallpaper Service allow a low-privileged local user to send crafted commands that carry an attacker-controlled file path, bypassing the service's intended path restrictions and abusing its higher-privileged context. Because the service exposes a communication channel that fails to properly restrict callers or validate file names (CWE-923), a local user can read, write, or manipulate files outside the intended scope, with high impact to confidentiality, integrity, and availability; on certain ASUS models exploitation can also render a single feature unavailable. No public exploit is identified at time of analysis, and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.5 (High) reflects meaningful impact despite the local vector and high attack complexity. | HIGH | 8.5 | 0.1% | 42 |
No patch
|
| CVE-2026-8917 | Privilege escalation via untrusted pointer dereference in ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll exposes local attackers to arbitrary kernel memory writes through vulnerable IOCTL handlers in the associated kernel-mode drivers. The flaw (CWE-822) permits a caller supplying an attacker-controlled pointer to force the driver to write a specific value to an arbitrary memory address, enabling elevation of privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the high CVSS 4.0 score of 8.4 and confirmed arbitrary-write primitive make this a meaningful local privilege escalation risk on affected systems. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-15029 | Arbitrary physical memory read/write in the ASUS System Control Interface (v3 and legacy) and ASUS Business Manager driver allows a local administrator to issue crafted IOCTL requests that bypass OS-enforced memory protections, per an ASUS-published advisory. The flaw (CWE-822, Untrusted Pointer Dereference) turns the signed ASUS driver into a read/write primitive over physical memory, enabling privilege escalation from admin to kernel and potential defense evasion. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-13585 | Local information disclosure and denial of service in the ASUS System Control Interface driver (v3 and earlier) and ASUS Business Manager lets a user already holding local administrator rights issue crafted IOCTL requests to read leftover sensitive data from kernel/driver buffers and, in severe cases, exhaust unthrottled resources to crash the host. The flaw stems from missing resource limits (CWE-770) combined with reuse of memory that still contains prior sensitive contents. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; ASUS self-reported and issued an advisory. | HIGH | 8.2 | 0.1% | 41 |
No patch
|
| CVE-2026-19397 | Unauthenticated adjacent-network host takeover in ASUS Control Center Express Agent exposes critical management functions without any authentication check (CWE-306), allowing any attacker with network adjacency to directly connect to the agent and fully control the host. The attack is contingent on the host having an active login session at the time of exploitation. No public exploit code has been identified at time of analysis, but the unauthenticated nature and high CIA impact make this a meaningful risk in environments where ASUS Control Center is deployed across managed workstations or servers. | HIGH | 7.7 | 0.2% | 38 |
No patch
|
| CVE-2022-4990 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validation and access restricted memory blocks. Rated high severity (CVSS 7.3). No vendor patch available. | HIGH | 7.3 | 0.1% | 37 |
No patch
|
| CVE-2026-7480 | Local privilege escalation in ASUS System Control Interface allows an authenticated low-privileged user to gain SYSTEM-level code execution by issuing a crafted RPC call that bypasses the component's validation logic. The flaw stems from incorrect permission assignment (CWE-732) on a critical resource exposed over RPC, and no public exploit identified at time of analysis. CVSS 4.0 scores it 7.3 with high attack complexity, indicating exploitation is non-trivial but yields full host compromise. | HIGH | 7.3 | 0.0% | 37 |
No patch
|
| CVE-2026-8070 | Local privilege escalation in ASUS Armoury Crate allows an authenticated low-privileged user to bypass driver validation and gain unauthorized read/write access to physical memory. The flaw stems from incorrect permission assignment (CWE-732) on a critical resource exposed by the application's kernel driver, enabling memory tampering that can be leveraged for full system compromise. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. | HIGH | 7.3 | 0.0% | 37 |
No patch
|
| CVE-2026-8919 | Credential theft in ASUS GameSDK allows a remote attacker to capture a local user's NTLM hash by luring them to a crafted web page that abuses a permissive cross-domain policy to send a UNC-path request to GameSDK's local service endpoint. The flaw affects systems running the ASUS GameSDK local service (bundled with ASUS gaming utilities) and requires the victim to visit an attacker-controlled page (UI required); no authentication is needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the leaked NTLM material can be relayed or cracked to reach other services. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-8918 | Local privilege abuse in ASUS Armoury Crate (versions up to and including 6.4.12) allows a local administrator to bypass input validation and perform arbitrary kernel memory read/write or trigger a system crash (BSOD). The flaw is reported by ASUS and tracked as EUVD-2026-38205; no public exploit identified at time of analysis. CVSS 4.0 base score is 7.1 with high attack complexity and high privileges required, reflecting that exploitation needs an existing administrative foothold. | HIGH | 7.1 | 0.2% | 36 |
No patch
|