High severity · published Jul 15, 2026
CVE-2026-13585
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business…
8.2
CVSS
0.2%
EPSS
No
On KEV
Description
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system.
Refer to the '
Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BM
Business Manager · ASUS
through v3.0.38.0 · source: vendor
SC
System Control Interface · ASUS
before v1.1.40.0 · source: vendor
SC
System Control Interface v3 · ASUS
before v3.1.66.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13585
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13585
www.asus.com
https://www.asus.com/security-advisory/
seclists.org
http://seclists.org/fulldisclosure/2026/Jul/26
More from Business Manager
8.4
CVE-2026-15029
Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary…
5.6
CVE-2026-15030
Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the…
