CVE-2026-19397: ASUS Control Center Express Auth Bypass

CVE-2026-19397 Overview

CVE-2026-19397 is a missing authentication vulnerability in the ASUS Control Center Express Agent. An unauthenticated adjacent-network attacker can connect directly to the agent and control the host when an active login session exists on the target machine. The flaw is classified as [CWE-306] Missing Authentication for Critical Function.

The issue affects endpoint management components used by ASUS Control Center Express. ASUS documents remediation in the Security Update for ASUS Control Center Express Agent section of its advisory portal.

Critical Impact
An adjacent attacker with network reach to the agent can gain full control over the host, compromising confidentiality, integrity, and availability without any user interaction or credentials.

Affected Products

ASUS Control Center Express Agent (see vendor advisory for version details)
Windows hosts running the vulnerable agent with an active login session
Environments where the agent is exposed on the adjacent network

Discovery Timeline

2026-09-08 - CVE-2026-19397 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-19397

Vulnerability Analysis

The ASUS Control Center Express Agent exposes a critical control function without enforcing authentication on inbound connections. An attacker on the same broadcast domain or otherwise adjacent network can open a direct connection to the agent process and issue privileged commands. When the host has an active login session, the attacker can leverage the agent's inherited session context to control the machine.

The attack requires no credentials and no user interaction. Attack complexity is low, but the attacker must satisfy a prerequisite condition tied to the presence of an interactive session on the target. Successful exploitation yields high impact to confidentiality, integrity, and availability of the compromised host.

Root Cause

The root cause is a missing authentication check on a critical management function exposed by the agent's listening service. The agent accepts and acts on control requests from any adjacent client without validating the requester's identity or authorization. This design gap maps directly to [CWE-306], where a security-sensitive function is reachable without authentication.

Attack Vector

The attack vector is adjacent network. An attacker within the local network segment locates a host running the vulnerable agent, establishes a direct connection to the agent's exposed endpoint, and submits control commands. Because the vulnerable code path bypasses authentication, the agent processes the request as if it originated from a legitimate management source. The presence of an active login session on the host provides the execution context needed for full host takeover.

No public proof-of-concept code has been released. Technical specifics are documented in the ASUS Security Advisory.

Detection Methods for CVE-2026-19397

Indicators of Compromise

Unexpected inbound TCP connections to the ASUS Control Center Express Agent listener from non-management hosts on the local subnet.
Agent-initiated process creation events on hosts with an active user session that do not correlate with scheduled management jobs.
Configuration or policy changes on managed endpoints without a matching change record from the ASUS Control Center Express console.

Detection Strategies

Baseline the set of legitimate management servers that communicate with the agent and alert on connections from any other source on the adjacent network.
Correlate agent process activity with interactive login session events to surface actions taken outside of scheduled maintenance windows.
Hunt for agent child processes spawning command shells, scripting hosts, or remote access tooling.

Monitoring Recommendations

Enable verbose logging on the ASUS Control Center Express Agent and forward events to a central SIEM for correlation.
Monitor local-network traffic for connections targeting the agent's listening port from unauthorized systems.
Track logon session state on managed endpoints and flag agent activity that coincides with unexpected interactive sessions.

How to Mitigate CVE-2026-19397

Immediate Actions Required

Apply the vendor update referenced in the Security Update for ASUS Control Center Express Agent section of the ASUS advisory as soon as it is available for your version.
Inventory all hosts running the agent and confirm patch status across managed endpoints.
Restrict adjacent-network access to agent listener ports using host firewall rules that permit only the authorized management server.

Patch Information

Refer to the ASUS Security Advisory for the corrected agent build and applicable version numbers. Deploy the fixed agent through the ASUS Control Center Express management console or an equivalent software distribution mechanism.

Workarounds

Segment management traffic onto a dedicated VLAN and block agent ports from user and guest networks.
Disable or uninstall the agent on hosts that do not require ASUS Control Center Express management until the patch is deployed.
Enforce host-based firewall rules that allow inbound connections to the agent only from known management server IP addresses.

bash

# Example Windows Firewall rule restricting agent access to a management server
netsh advfirewall firewall add rule name="ASUS ACC Agent - Restrict" ^
  dir=in action=allow ^
  program="%ProgramFiles(x86)%\ASUS\ControlCenterExpressAgent\agent.exe" ^
  remoteip=<MANAGEMENT_SERVER_IP> enable=yes

netsh advfirewall firewall add rule name="ASUS ACC Agent - Block Others" ^
  dir=in action=block ^
  program="%ProgramFiles(x86)%\ASUS\ControlCenterExpressAgent\agent.exe" ^
  enable=yes