Vulnerability · Published Sep 8, 2026 · Assigned by ASUS
CVE-2026-19397
High 7.7
In plain English
A high-severity missing authentication in Control Center Express Agent from ASUS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent ' section on the ASUS Security Advisory for more information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ASUS | Control Center Express Agent | before v1.7.24 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N