CVE-2026-9789: Acer NitroSense Privilege Escalation Flaw

CVE-2026-9789 Overview

CVE-2026-9789 is a Local Privilege Escalation (LPE) vulnerability in Acer NitroSense software versions prior to 3.01.3052. The PSAdminAgent service creates a Named Pipe with a weak Access Control List (ACL). Any authenticated local user can connect to the pipe and issue commands. The service executes file deletion operations without validating caller privileges, allowing low-privileged users to delete arbitrary files with SYSTEM authority. The flaw is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
A low-privileged local user can delete arbitrary files with SYSTEM privileges, enabling denial of service and potential privilege escalation through file removal of security-critical components.

Affected Products

Acer NitroSense software versions prior to 3.01.3052
Acer PSAdminAgent service (component of NitroSense)
Acer Nitro-series systems with NitroSense installed

Discovery Timeline

2026-05-28 - CVE-2026-9789 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-9789

Vulnerability Analysis

The PSAdminAgent service runs with SYSTEM privileges and exposes its functionality through a Windows Named Pipe. The pipe is created with a permissive ACL that grants connection and write access to any authenticated user on the local system. This design allows the inter-process communication channel to act as an unauthenticated command interface for any user session on the host.

When a client connects, the service accepts commands including file deletion operations. The service does not perform impersonation checks, token validation, or path restriction against the caller. As a result, the deletion handler executes file removal under the SYSTEM context using attacker-supplied paths.

This pattern enables arbitrary file deletion as SYSTEM. Attackers can leverage arbitrary delete primitives to remove protected files, corrupt the Windows installation, or chain with known techniques to achieve full SYSTEM code execution through DLL planting or installer repair flows.

Root Cause

The root cause is twofold: a Named Pipe created with an overly permissive ACL, and missing authorization logic in the privileged service. The PSAdminAgent trusts every connected client to be authorized, treating IPC connectivity as a proxy for entitlement. Path validation against the caller's own access rights is absent.

Attack Vector

Exploitation requires local access and valid credentials on the target host. An attacker opens a handle to the PSAdminAgent Named Pipe, sends a properly formatted delete command containing the target file path, and the service performs the deletion as SYSTEM. The vulnerability manifests as a path traversal and authorization flaw rather than a memory corruption issue. See the Acer Community Article for vendor technical details.

Detection Methods for CVE-2026-9789

Indicators of Compromise

Unexpected client connections to the PSAdminAgent Named Pipe from non-Acer processes or user-context binaries.
File deletion events in protected directories (C:\Windows\System32, C:\Program Files) where the parent process is PSAdminAgent.exe but the originating user session is non-administrative.
Crashes or repair prompts for Windows services and signed software following user logon events.

Detection Strategies

Monitor Sysmon Event ID 17 and 18 (Named Pipe created/connected) for connections to pipes owned by PSAdminAgent.exe from unexpected client processes.
Audit file deletion events (Security Event ID 4660 with 4663) where the subject process is PSAdminAgent.exe and verify against expected administrative workflows.
Inventory endpoints running Acer NitroSense and confirm installed versions are at or above 3.01.3052.

Monitoring Recommendations

Baseline normal PSAdminAgent IPC behavior and alert on anomalous client process names or command frequency.
Track creation and removal of files in security-sensitive paths attributed to OEM utility services.
Forward endpoint process and pipe telemetry to a centralized analytics platform for correlation with logon and privilege escalation indicators.

How to Mitigate CVE-2026-9789

Immediate Actions Required

Update Acer NitroSense to version 3.01.3052 or later on all affected Nitro-series endpoints.
Identify the installed NitroSense version using software inventory tooling and prioritize hosts with multiple interactive user accounts.
Restrict interactive logon on shared systems until the patch is deployed to reduce the local-attacker surface.

Patch Information

Acer has released NitroSense version 3.01.3052, which addresses the weak Named Pipe ACL and adds caller privilege validation in the PSAdminAgent service. Refer to the Acer Community Article for download links and release notes.

Workarounds

Stop and disable the PSAdminAgent service where NitroSense functionality is non-essential, using sc config PSAdminAgent start= disabled.
Remove the NitroSense package entirely on endpoints that do not require Acer system tuning features.
Apply application allowlisting to block unauthorized binaries from connecting to the vulnerable Named Pipe until patching is complete.

bash

# Configuration example: disable the vulnerable service until patched
sc stop PSAdminAgent
sc config PSAdminAgent start= disabled