Vulnerability · Published May 28, 2026 · Assigned by Acer
CVE-2026-9789NitroSense V3: Security Vulnerability Information
High 8.5
In plain English
A high-severity path traversal in NitrorSense V3 from Acer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authenticated local user to connect and send commands. Because the service does not check the caller's privileges before running file deletion commands, a low-privileged local user can exploit this to delete arbitrary files with system authority.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Acer | NitrorSense V3 | 3.01.3001 – through 3.01.3052 |
Weakness: CWE-22, CWE-269, CWE-284, CWE-732 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N