Missing Authentication in ASUS Control Center Express Agent Allows Host Takeover
CVE-2026-19397 is a missing-authentication flaw (CWE-306) in the ASUS Control Center Express (ACE) Agent, the endpoint component of ASUS's fleet-management software. An unauthenticated user on the adjacent network segment can make a direct connection to the agent and take control of the host, but only while the host has an active login session. Because no credentials are required, the attacker gains full control of the machine — the CVSS 4.0 base score of 7.7 (High) rates confidentiality, integrity, and availability impact on the vulnerable host as High, and related coverage describes unauthenticated attackers obtaining root-level access. Organizations running the ACE Agent on managed ASUS endpoints are affected, particularly where the agent is reachable from untrusted LAN segments. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, EPSS is low (0.2% in 30 days), and ASUS has published a security update addressing it.
· ASUS Control Center Express Agent
In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking.
In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
· google android—
Exposed IOCTL with Insufficient Access Control in ASUS Armoury Crate Driver
ASUS Armoury Crate ships a driver component that exposes an IOCTL with insufficient access control (CWE-782), allowing a low-privileged local user to bypass the driver's authentication mechanism. By sending IOCTL requests directly, the attacker can read from and write to PCI Express configuration space. Successful exploitation can disclose sensitive system information and disable device functionality, consistent with the high integrity and availability impacts in the CVSS 4.0 score. Affected users are those running ASUS Armoury Crate, which ASUS preinstalls on ROG/TUF gaming laptops, desktops, and motherboards. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS puts the 30-day exploitation probability at just 0.1%.
· ASUS Armoury Crate (App and driver component)mass
Local Hardware-Config Tampering in ASUS Armoury Crate
ASUS Armoury Crate contains an improper restriction of software interfaces to hardware features (CWE-1256), allowing a local user to bypass driver authentication and directly access critical model-specific registers. The flaw is triggered locally by a low-privileged user without user interaction, though with high attack complexity (CVSS v4.0 5.8: AV:L/AC:H/PR:L/UI:N). A successful exploit lets the attacker modify hardware configuration settings and potentially cause hardware damage, yielding high integrity and availability impact. Any user running the ASUS Armoury Crate utility on ASUS systems is affected; affected and fixed versions are specified in the 'Security Update for Armoury Crate App' section of the ASUS Security Advisory. No public proof of concept, no CISA KEV listing, and a low EPSS of 0.1% mean exploitation is not currently known, and the separately reported ASUS Control Center root-access flaw is a distinct issue.
· ASUS Armoury Cratemass
Invalid Pointer Release in ASUS Armoury Crate Driver Lets Local Users Crash Systems
CVE-2026-16005 is an invalid pointer release flaw (CWE-763) in the driver bundled with ASUS Armoury Crate, ASUS's control software for its gaming hardware. A local, low-privileged user can trigger it by sending a crafted IOCTL request that bypasses the driver's verification, causing the driver to free arbitrary memory. The resulting corruption of data structures can crash the system with a blue screen (BSOD); the CVSS 4.0 vector indicates high integrity and availability impact with no confidentiality loss, and no network access or user interaction is required. Any machine with the Armoury Crate driver installed is affected, which broadly covers ASUS gaming motherboards, laptops and desktops. There is no evidence of exploitation in the wild, no public proof-of-concept, and the EPSS probability is low (0.1% over 30 days).
· ASUS Armoury Crate (driver component)mass
Local DoS via Unrestricted Memory Allocation in ASUS Armoury Crate
CVE-2026-75808 is a resource-allocation flaw (CWE-770) in ASUS Armoury Crate in which the software allocates system memory without limits or throttling. A local user can trigger it by bypassing driver authentication and then allocating an unrestricted amount of memory, exhausting system memory and causing a denial-of-service condition. Per the CVSS 4.0 vector (AV:L/AC:H/PR:L/VA:H), the attack requires local access with low privileges, carries high attack complexity, and impacts availability only — the attacker gains a system crash or DoS, not data exposure or privilege escalation. All users with ASUS Armoury Crate installed on ASUS systems (gaming motherboards, laptops, and desktops where it ships as bundled companion software) are potentially affected. Exploitation is currently unknown: no public proof-of-concept exists, EPSS is 0.1% (1st percentile), the flaw is not in CISA KEV, and no fixed version numbers are listed in the source data.
· ASUS Armoury Crate (Armoury Crate App and its associated driver component)mass
Kernel Address Information Disclosure in ASUS Armoury Crate Driver
CVE-2026-16006 is an information disclosure flaw (CWE-497) in the driver bundled with ASUS Armoury Crate, which fails to properly verify certain IOCTL requests. A local user with limited privileges can send a crafted IOCTL that bypasses the driver's verification checks and retrieve kernel virtual addresses. The disclosed addresses reveal the kernel memory layout, which is most valuable as a stepping stone in a chained attack, for example defeating kernel address-space randomization when exploiting a second bug. Any user of an ASUS system with the Armoury Crate driver installed (typically ROG/TUF gaming desktops, laptops and motherboards where Armoury Crate is bundled) is affected; the attack requires existing local code execution. There are no reports of in-the-wild exploitation, no public proof-of-concept, it is not in CISA's KEV catalog, and EPSS estimates only a 0.1% chance of exploitation in the next 30 days.
· ASUS Armoury Crate (bundled driver)mass
Local Information Disclosure in ASUS Armoury Crate Driver via Crafted IOCTL Requests
CVE-2026-18023 is an information disclosure flaw (CWE-226, Sensitive Information in Resource Not Removed Before Reuse) in the driver component of ASUS Armoury Crate, ASUS's tuning and control software bundled with its ROG/TUF gaming motherboards, laptops, and desktops. A local user with low privileges can send a specially crafted IOCTL request that bypasses the driver's security verification mechanism, causing the driver to return memory that has not been cleared of previously stored data. The attacker gains disclosure of sensitive information left in uninitialized memory, with high confidentiality impact but no integrity or availability impact per the CVSS 4.0 score of 5.7 (medium). Affected users are those running the Armoury Crate driver on ASUS systems; the vendor has published a fix in the 'Security Update for Armoury Crate App' section of its security advisory. There is currently no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days.
· ASUS Armoury Crate (driver component)mass
Cross-Domain NTLM Hash Leak in ASUS Armoury Crate Local Service
ASUS Armoury Crate, the bundled management software shipped with ASUS ROG/TUF motherboards, laptops and desktops, runs a local service whose endpoint accepts requests from untrusted web origins due to a permissive cross-domain security policy (CWE-942). An attacker triggers the flaw by convincing a logged-in Windows user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint, causing the system to authenticate to a resource of the attacker's choosing. The attacker obtains the local user's NTLM hash, which can be cracked offline or relayed to other services that accept NTLM authentication. Any Windows user running Armoury Crate on an ASUS system is affected; exploitation requires user interaction and results in credential disclosure rather than code execution. No public proof of concept is known, the flaw is not in CISA's KEV catalog, EPSS assigns a 0.4% probability of exploitation in the next 30 days, and ASUS scores it medium severity (CVSS 4.0: 5.3), so no active exploitation is currently known.
· ASUS Armoury Cratemass
Exposed IOCTL in ASUS Armoury Crate driver allows local whitelist bypass
ASUS Armoury Crate's bundled driver exposes an IOCTL interface with insufficient access control (CWE-782), letting a local user bypass the driver's verification and add an arbitrary process identifier to the driver's whitelist. An attacker with low privileges on the machine can trigger this by sending a crafted IOCTL request, gaining limited integrity impact by getting a process of their choice treated as trusted by the driver. The flaw is rated Low (CVSS 4.0 score 2.0) because it requires local access, involves high attack complexity, and has a low-only integrity impact, and it affects systems running the Armoury Crate driver that ASUS bundles with its motherboards and gaming products. No public proofs of concept are known, the issue is not on the CISA KEV list, and EPSS currently estimates only a 0.1% probability of exploitation in the next 30 days. ASUS has addressed it via the 'Security Update for Armoury Crate App' section of its security advisory, though specific affected or fixed version numbers were not provided in the available data.
· ASUS Armoury Crate (bundled driver component)mass