VulnSocial

CVE-2026-19397Patch

MEDIUMCVSS 7.7 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the '  Security Update for ASUS Control Center Express Agent ' section on the ASUS Security Advisory for more information.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-09-08); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-09-08: 2Mentions · 2026-09-12: 1Mentions · 2026-09-16: 1Active Exploitation · 2026-09-08: 1Patch / Workaround · 2026-09-08: 1Patch / Workaround · 2026-09-12: 1Patch / Workaround · 2026-09-16: 1Technical Details · 2026-09-08: 1Technical Details · 2026-09-12: 1Technical Details · 2026-09-16: 109-0809-1209-16
Signal classification3 categories
Patch
250.0%
Active Exploitation
125.0%
Disclosure
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-082
Active Exploitation1Patch1
2026-09-121
Disclosure1
2026-09-161
Patch1
Full discourse4 posts
  • Security Arsenal, LLC@SecurityAr58409
    Disclosure

    🔒 #CyberSecurity CVE-2026-19397: ASUS Control Center Express Agent Unauthenticated RCE (ZDI-26-6… "The Zero Day Initiative has published ZDI-26-657, disclosing a critical missing-authentication…" 🔗 https://securityarsenal.com/blog/cve-2026-19397-asus-control-center-express-agent-unauthenticated-rce-zdi-26-657-detection-and-remediation-guide #CyberSecurity #ThreatIntel #critical #zeroday #cve

    Post summary

    The post announces the Zero Day Initiative’s disclosure of CVE‑2026‑19397, an unauthenticated remote code execution flaw in ASUS Control Center Express Agent, and points to a remediation guide. No evidence of active exploitation or PoC code is presented.

    0000190
    31 followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    An ASUS vulnerability (CVE-2026-19397) lets a nearby attacker take over a host, while an Armoury Crate flaw leaks NTLM hashes. Update now. #ASUS #ArmouryCrate #ControlCenterExpress #CVE202619397 #NTLM #PrivilegeEscalation #PatchNow #Infosec https://securityonline.info/asus-control-center-express-armoury-crate/ https://t.co/RLsPIt5zXD

    Post summary

    A brief notice of a new ASUS vulnerability (CVE‑2026‑19397) that enables local takeover and NTLM hash leakage, with a call for users to apply updates immediately.

    00001458
    12.9K followersView on X
  • iototsecnews@iototsecnews
    Patch

    ASUS Control Center Critical の脆弱性 CVE-2026-19397：認証の欠如と root アクセス https://iototsecnews.jp/2026/09/08/asus-control-center-critical-flaw-allows-unauthenticated-attackers-to-gain-root-access/ ASUS Control Center Express Agent において認証処理の欠如が存在します。近隣のネットワークから未認証のまま接続されることで root 権限によるコード実行を許し、ホスト全体が制御される恐れがあります。 CVE-2026-19397 が割り当てられたこの問題への対処として、バージョン 1.7.24 以降への更新 ／アクセス可能なインターフェイスの確認／ネットワーク分離や壁による制限／不審な接続やプロセスの監視が求められます。また Armory Crate App にも CVE-2026-12962／CVE-2026-18023／CVE-2026-16003～CVE-2026-16006／CVE-2026-75808～CVE-2026-75811 が影響するため、併せて確認が必要です。 #Asus #ControlCenterExpressAgent #CVE202619397 #Vulnerability

    Post summary

    The tweet reports an authentication bypass vulnerability (CVE‑2026‑19397) in ASUS Control Center Express Agent that can let unauthenticated attackers execute code as root. It provides remediation steps, including updating to version 1.7.24 or later, checking accessible interfaces, and implementing network segmentation.

    00000104
    513 followersView on X
  • VulDB 🛡@vuldb
    Active Exploitation

    Attention, elevated activities detected targeting ASUS Control Center Express Agent (CVE-2026-19397) https://vuldb.com/vuln/399713/cti

    Post summary

    Alert indicating active, elevated attack activity against ASUS Control Center Express Agent via CVE-2026-19397.

    0000094
    2.3K followersView on X

Explore more

Back to dashboard