CVE-2026-8921

HighCVSS 8.5

Published: 03/07/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

A vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. The issue stems from external control of file name or path.

Risk Assessment

An attacker with local access can gain full system control, potentially installing malware, stealing data, or disrupting services.

Recommendation

Immediately apply the security update for ASUS Business Manager as per the ASUS Security Advisory.

Other vulnerabilities in ASUS Business Manager

CVE-2025-13348High
An improper access control vulnerability exists in the ASUS Secure Delete Driver of ASUS Business Manager. A local user can trigger it by sending a specially crafted request, potentially leading to arbitrary file creation in a specified path.

Original NVD description (English source)

External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. Refer to the ' Security Update for ASUS Business Manager ' section on the ASUS Security Advisory for more information.