13
CVEs
1
Critical
1
High
0
KEV
0
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
1
MEDIUM
10
LOW
1
Monthly CVE Trend
Affected Products (30)
Asmb8 Ikvm Firmware
19
Z10Pe D16 Ws Firmware
18
Rt Ac86U Firmware
18
Z10Pr D16 Firmware
18
E700 G4 Firmware
17
Rs720A E9 Rs12V2 Firmware
17
Rs700A E9 Rs4 Firmware
17
Rs500A E10 Rs4 Firmware
17
Rs700 E9 Rs12 Firmware
17
Rs500 E9 Rs4 Firmware
17
Z11Pa D8 Firmware
17
Ws X299 Pro Se Firmware
17
Rs500A E9 Rs4 Firmware
17
Z11Pa D8C Firmware
17
Esc4000 G4X Firmware
17
Rs720Q E9 Rs8 Firmware
17
Rs720 E9 Rs24 U Firmware
17
Rs520 E9 Rs8 Firmware
17
Rs520 E9 Rs12 E Firmware
17
Esc4000 Dhd G4 Firmware
17
Rs720A E9 Rs24V2 Firmware
17
Rs720A E9 Rs24 E Firmware
17
Rs720 E9 Rs8 G Firmware
17
Rs100 E10 Pi2 Firmware
17
Knpa U16 Firmware
17
Esc4000 G4 Firmware
17
Z11Pa U12 Firmware
17
Rs500 E9 Ps4 Firmware
17
Rs500A E9 Rs4 U Firmware
17
Ws C422 Pro Se Firmware
17
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75754 | Unauthenticated remote root compromise of ASUS Control Center (Enterprise/ACC) is possible by chaining a missing-authentication flaw, an SSRF, and hard-coded credentials: an attacker retrieves the product's encryption key over a plain HTTP request, which causes a local service to enable SSH on port 2222, then logs in with built-in credentials to gain a root shell. From that shell an attacker can read, write, and delete all ACC data and remotely control every managed server, PC, and workstation in the environment. ASUS assigns CVSS 4.0 base 10.0; no public exploit identified at time of analysis. | CRITICAL | 10.0 | 0.2% | 50 |
No patch
|
| CVE-2026-19397 | Unauthenticated adjacent-network host takeover in ASUS Control Center Express Agent exposes critical management functions without any authentication check (CWE-306), allowing any attacker with network adjacency to directly connect to the agent and fully control the host. The attack is contingent on the host having an active login session at the time of exploitation. No public exploit code has been identified at time of analysis, but the unauthenticated nature and high CIA impact make this a meaningful risk in environments where ASUS Control Center is deployed across managed workstations or servers. | HIGH | 7.7 | 0.2% | 38 |
No patch
|
| CVE-2026-19398 | Out-of-bounds write in the SmiFlash SMM (System Management Mode) module affects ASUS FA507NU and FA507NV laptop BIOS firmware across all versions. A local administrator can dispatch a crafted Software SMI (SW SMI) request with an oversized length value, causing the SmiFlash handler to write beyond its allocated SMRAM buffer boundary, resulting in a system crash (BSOD) or irreversible BIOS flash corruption. The affected models are designated 'unsupported-when-assigned,' meaning these products were already outside active vendor support when this CVE was issued; no public exploit has been identified at time of analysis. | MEDIUM | 6.8 | 0.1% | 34 |
No patch
|
| CVE-2026-16004 | Arbitrary PCI/PCIe configuration space read and write access through the ASUS Armoury Crate kernel driver exposes a local low-privileged user to hardware-level integrity and availability risks by bypassing the driver's IOCTL verification logic. All tracked versions of Armoury Crate are affected (CPE wildcard), meaning any Windows-based ASUS gaming system with the software installed is in scope. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects the constrained local/high-complexity exploitation model. | MEDIUM | 5.9 | 0.1% | 30 |
No patch
|
| CVE-2026-75809 | Insufficient access control on an exposed IOCTL interface in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly manipulate PCIe configuration space, enabling both hardware configuration disclosure and hardware disablement. The vulnerability stems from the kernel driver accepting IOCTL requests without validating caller privilege against the required access level, granting unprivileged processes read and write access to raw PCIe registers. No public exploit code has been identified at time of analysis, and no KEV listing exists, though the local nature of the attack limits the attack surface to already-compromised or multi-user systems. | MEDIUM | 5.9 | 0.1% | 30 |
No patch
|
| CVE-2026-16005 | Arbitrary memory freeing in the ASUS Armoury Crate kernel driver allows a local low-privileged user to trigger system crashes (BSOD) and corrupt kernel data structures. The driver's IOCTL handling fails to validate pointer references before releasing memory, and an attacker can bypass this verification to free arbitrary kernel memory via a crafted IOCTL request. No public exploit or KEV listing exists at time of analysis; the CVSS 4.0 score of 5.8 reflects the local, high-complexity attack surface. | MEDIUM | 5.8 | 0.1% | 29 |
No patch
|
| CVE-2026-75811 | Local privilege escalation in ASUS Armoury Crate allows a low-privileged local user to bypass the software's driver authentication and directly access model-specific registers (MSRs) or other hardware control interfaces, enabling unauthorized modification of hardware configuration settings such as voltage, power limits, and thermal thresholds. This is classified under CWE-1256, which covers software that fails to properly restrict userland access to hardware-level features exposed through drivers. In a worst case, exploitation could result in irreversible hardware damage by pushing components beyond manufacturer-safe operating parameters. No public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 5.8 | 0.1% | 29 |
No patch
|
| CVE-2026-16006 | Kernel virtual address disclosure in the ASUS Armoury Crate Windows driver enables a local low-privileged user to bypass the driver's IOCTL input verification through a crafted request, obtaining kernel virtual addresses and exposing the kernel memory layout. All versions of Armoury Crate are listed as affected per CPE cpe:2.3:a:asus:armoury_crate:*:*:*:*:*:*:*:*. While direct impact is limited to information disclosure, this class of kernel pointer leak is routinely used to defeat KASLR as a prerequisite step in local kernel privilege-escalation chains; no public exploit or CISA KEV listing has been identified at time of analysis. | MEDIUM | 5.7 | 0.1% | 29 |
No patch
|
| CVE-2026-18023 | Uninitialized kernel memory disclosure through the ASUS Armoury Crate Windows driver allows a local low-privileged user to read sensitive data from previously used kernel buffers. The attacker crafts a malicious IOCTL request that bypasses the driver's built-in security verification mechanism, triggering a read of uncleared memory content (CWE-226). No active exploitation has been identified and no public exploit code is known at time of analysis; risk is bounded by the local access prerequisite and the AC:H complexity of defeating the security check. | MEDIUM | 5.7 | 0.1% | 29 |
No patch
|
| CVE-2026-75808 | Memory exhaustion denial-of-service in ASUS Armoury Crate allows a local authenticated user to bypass the kernel-mode driver's authentication mechanism and issue unlimited memory allocation requests, saturating available system memory. The vulnerability is classified CWE-770 (Allocation of Resources Without Limits or Throttling) and is scoped to local availability impact only - no confidentiality or integrity loss occurs. No public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 5.7 | 0.1% | 28 |
No patch
|
| CVE-2026-75810 | Local denial-of-service in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly invoke the driver's System Management Interrupt (SMI) triggering capability, a function classified under CWE-749 as an exposed dangerous method. Repeatedly calling this function forces the CPU into System Management Mode in rapid succession, producing brief but repeatable system stalls that can escalate into a denial-of-service condition. No public exploit code exists and the vulnerability is not listed in CISA KEV, but ASUS has released a security advisory with an available fix. | MEDIUM | 5.7 | 0.1% | 28 |
No patch
|
| CVE-2026-12962 | NTLM credential hash theft from Windows users running ASUS Armoury Crate is possible when a user visits an attacker-controlled web page that exploits the application's permissive cross-domain (CORS) policy. The local Armoury Crate service accepts cross-origin requests from untrusted web origins, allowing malicious JavaScript to inject a UNC path into a service call; Windows then automatically initiates SMB authentication to the attacker's server, transmitting the user's NTLMv2 hash without further interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the underlying coercion technique is well-understood and the attack requires only a single user click. | MEDIUM | 5.3 | 0.4% | 26 |
No patch
|
| CVE-2026-16003 | The Armoury Crate kernel-mode driver on ASUS systems exposes an IOCTL interface without adequate caller verification, enabling a locally authenticated low-privilege user to inject arbitrary process identifiers into the driver's trusted-process whitelist via a crafted IOCTL request. Bypassing this verification (CWE-782) allows the attacker's process to assume whitelisted trust status within the driver, gaining access to driver functions ordinarily restricted to ASUS's own software. No public exploit has been identified and the vendor-assigned CVSS 4.0 score of 2.0 reflects the constrained real-world impact: local-only access, high exploitation complexity, and limited integrity gain. | LOW | 2.0 | 0.1% | 10 |
No patch
|