Reported by 3 outlets

Timeline

1. original reporting

   Critical ASUS Control Center CVE-2026-75754 Flaw Allows Unauthenticated Root Access

   gbhackers.com · 37d ago · September 7th, 2026

   ASUS has issued a security bulletin regarding a critical vulnerability in ASUS Control Center Enterprise (ACC), identified as CVE-2026-75754. This flaw affects ACC version 4.0.0.2 and earlier, allowing for unauthenticated root access. Critical ASUS Control Center Flaw The advisory was published on September 4, 2026, and was last updated on the same day. While the […] The post Critical ASUS Control Center CVE-2026-75754 Flaw Allows Unauthenticated Root Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Critical ASUS Control Center Flaw Lets Unauthenticated Attackers Gain Root Access

   cyberpress.org · 37d ago · September 7th, 2026

   ASUS has released a security update for a critical vulnerability in ASUS Control Center Enterprise (ACC) , warning that unauthenticated attackers could exploit the flaw to obtain root-level access on affected systems. ASUS Control Center Enterprise is used by organizations to centrally manage ASUS servers, workstations, and other supported infrastructure. Critical ASUS Control Center Flaw The platform can provide administrators with capabilities for device monitoring, inventory management, remote configuration, software deployment, and system maintenance. Because such products commonly operate with elevated privileges and access multiple managed endpoints, a compromise can create significant security risks across an enterprise environment. The vulnerability is especially serious because it can reportedly be exploited without authentication. An attacker who can access a vulnerable ASUS Control Center Enterprise instance may bypass the normal login requirement and gain root access to the underlying system. Root-level access is the highest privilege level on Linux and Unix-like systems. It allows an attacker to execute arbitrary commands, modify system configurations, access protected files, create new accounts, install persistence mechanisms, disable security tools, and potentially pivot to other systems available from the compromised host. While ASUS has not publicly disclo

3. update from gbhackers.com

   ASUS Control Center Critical Flaw Allows Unauthenticated Attackers to Gain Root Access

   gbhackers.com · 35d ago · September 8th, 2026

   ASUS has released a security update for the Control Center Express Agent to address CVE-2026-19397, a high-severity vulnerability related to missing authentication. This vulnerability allows an unauthenticated nearby attacker to potentially take control of an affected host through a direct connection to the agent.

4. update from sekurak.pl

   CVE-2026-75754: Critical RCE with Root Privileges (CVSS 10.0) in ASUS Control Center Enterprise

   sekurak.pl · 34d ago · September 9th, 2026

   RCE with Root Privileges: Critical Vulnerability (CVSS 10.0) in ASUS Control Center Enterprise

   ASUS disclosed a critical vulnerability in its popular ASUS Control Center Enterprise (ACC) software in its latest security bulletin. The vulnerability, tracked as CVE-2026-75754, received the maximum CVSS 4.0 score of 10.0. The vulnerability is actually a chain of three independent flaws that together create an effective attack chain:

   1. Missing input validation combined with a Server-Side Request Forgery (SSRF) vulnerability. By sending a specially crafted HTTP request to the ACC server, an attacker can extract the encryption key or session token. Using the captured secret, the attacker can invoke a specific API request, which triggers a local SSH server listening on TCP port 2222. The login credentials for the SSH service are hardcoded in the ACC application source code. Using them immediately grants access to a root shell, the highest possible privilege level. At this point the game is essentially over. They can scan hosts, remotely execute commands, install malware, or exfiltrate sensitive data. The vulnerability affects all software versions up to and including 4.0.0.2. ASUS has released an official security patch. Update to version 3.1.0.9 / 4.0.0.3 or newer immediately. If patching cannot be deployed right away, temporarily isolate the ACC management interface from the public internet and block traffic on port 2222. Source: https://sekurak.pl/rce-z-uprawnieniami-roota-krytyczna-podatnosc-cvss-10-0-w-asus-control-center-enterprise/