CVE-2026-8921
Received Received - Intake

External Control of File Name or Path in ASUS Business Manager

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: ASUS

Description
External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. Refer to the ' Security Update for ASUS Business Manager ' section on the ASUS Security Advisory for more information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-03
Last Modified
2026-07-03
Generated
2026-07-03
AI Q&A
2026-07-03
EPSS Evaluated
N/A
NVD
CVE-2026-8921
EUVD
EUVD-2026-41483

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
asus business_manager *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an External Control of File Name or Path issue in ASUS Business Manager. It allows a local user to execute arbitrary code with SYSTEM privileges by sending a tampered Inter-Process Communication (IPC) message.

Impact Analysis

The vulnerability can allow a local attacker to gain SYSTEM-level privileges on the affected system. This means the attacker could execute any code with the highest level of access, potentially leading to full system compromise.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart