CVE-2026-12962: Armoury Crate XSS Vulnerability

CVE-2026-12962 Overview

CVE-2026-12962 is a permissive cross-domain security policy vulnerability in the ASUS Armoury Crate application. The flaw allows a remote attacker to obtain a local user's NTLM (NT LAN Manager) hash. Exploitation requires convincing the user to visit a crafted web page that issues a request containing a Universal Naming Convention (UNC) path to Armoury Crate's local service endpoint. The vulnerability is tracked under CWE-942: Permissive Cross-domain Policy with Untrusted Domains.

Critical Impact
A remote attacker can coerce Windows into authenticating to an attacker-controlled Server Message Block (SMB) endpoint, exposing the victim's NTLM hash for offline cracking or relay attacks.

Affected Products

ASUS Armoury Crate App on Windows
See the ASUS Security Advisory for specific affected versions
Refer to the ASUS Security Advisory for the complete list

Discovery Timeline

2026-09-08 - CVE-2026-12962 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-12962

Vulnerability Analysis

Armoury Crate runs a local service endpoint on the host to support its management interface. The service accepts cross-origin requests from untrusted domains without adequate validation. An attacker hosting a malicious web page can trigger the local service to process attacker-supplied input. When that input contains a UNC path such as \\attacker.example.com\share, the Windows networking stack initiates an SMB connection to the remote host. During the SMB handshake, Windows automatically presents the current user's NTLM credentials. The attacker captures the resulting NetNTLM challenge-response and performs offline cracking or SMB relay to reach internal services.

Root Cause

The root cause is a permissive cross-domain security policy on the Armoury Crate local service. The application does not restrict which origins may submit requests, nor does it sanitize path parameters to reject UNC references. This combination of missing origin validation and unrestricted path handling enables the credential-leak primitive.

Attack Vector

Exploitation is remote and requires user interaction. The victim must browse to a page controlled by the attacker while Armoury Crate is running with its local service listening on the loopback interface. The malicious page issues a JavaScript request to the local endpoint with a UNC-formatted parameter. The local service dereferences the path, and Windows performs implicit NTLM authentication to the attacker's SMB listener. No credentials or elevated privileges are required on the attacker's side.

See the ASUS Security Advisory for technical details.

Detection Methods for CVE-2026-12962

Indicators of Compromise

Outbound SMB traffic on TCP ports 445 or 139 from workstations to unknown external hosts
Windows Security event ID 4624 or 4625 with NTLM authentication targeting non-corporate destinations
Browser-initiated requests to http://localhost or http://127.0.0.1 on Armoury Crate service ports followed by SMB egress
DNS lookups from endpoints to attacker-controlled domains immediately preceding SMB connections

Detection Strategies

Monitor endpoint process telemetry for the Armoury Crate service process initiating file access to UNC paths pointing to external hosts
Alert on any outbound SMB session from user endpoints leaving the corporate network perimeter
Correlate browser process activity with subsequent SMB or WebDAV connections within a short time window

Monitoring Recommendations

Enable NTLM auditing via Group Policy under Network security: Restrict NTLM to log outgoing NTLM traffic
Ingest firewall and proxy logs to identify SMB or WebDAV traffic destined for public IP ranges
Track invocations of the Armoury Crate local service and flag requests originating from browser-rendered origins

How to Mitigate CVE-2026-12962

Immediate Actions Required

Apply the security update referenced in the ASUS Security Advisory as soon as it is available for your environment
Block outbound SMB (TCP 445 and 139) and WebDAV traffic at the network perimeter to prevent credential exfiltration
Configure Windows to restrict outgoing NTLM authentication to remote servers via Group Policy

Patch Information

ASUS has published guidance in the "Security Update for Armoury Crate App" section of the ASUS Security Advisory. Install the latest Armoury Crate release on all affected Windows hosts. Verify the installed version after patching to confirm remediation.

Workarounds

Uninstall or stop the Armoury Crate service on systems that do not require its functionality
Enforce the Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers policy set to Deny all
Segment endpoints so that SMB egress to untrusted networks is blocked at host and network firewalls
Educate users to avoid opening unsolicited links while Armoury Crate is active

bash

# Configuration example: block outbound SMB via Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Outbound SMB 445" \
  -Direction Outbound -Action Block \
  -Protocol TCP -RemotePort 445 \
  -Profile Any

New-NetFirewallRule -DisplayName "Block Outbound SMB 139" \
  -Direction Outbound -Action Block \
  -Protocol TCP -RemotePort 139 \
  -Profile Any