High severity · published Sep 8, 2026
CVE-2026-19397
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent…
7.7
CVSS
0.3%
EPSS
No
On KEV
Description
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session.
Refer to the '
Security Update for ASUS Control Center Express Agent ' section on the ASUS Security Advisory for more information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Control Center Express Agent · ASUS
before v1.7.24 · source: vendor
In the news
VulnerabilityCritical
ZDI-26-657: ASUS Control Center Express Agent Missing Authentication Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ASUS Control Center Express Agent. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19397.
Sep 10, 2026·Zero Day Initiative