Is CVE-2026-8921 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8921 being exploited in the wild.

How severe is CVE-2026-8921?

Informational severity, with a CVSS score of 8.5, published 3 July 2026.

Which products and versions are affected?

ASUS Business Manager v3.0.38.0 and earlier.

Is there a fix for CVE-2026-8921?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8921 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-8921?

Check whether you run ASUS Business Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8921: ASUS Business Manager privilege escalation via tampered IPC message

CVE-2026-8921 · Severity: info · CVSS 8.5 · Published 2026-07-03

ASUS Business Manager, a software suite used for managing business PCs, contains a security flaw that allows a local user to gain full control over the computer. By sending a specially crafted message to the software, an attacker can execute commands with the highest level of system privileges. This could lead to a total compromise of the device, including unauthorized access to all data and the ability to disable security features.

Technologies: ASUS Business Manager. Vendors: ASUS.

Quick answers

Is CVE-2026-8921 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8921 being exploited in the wild.
How severe is CVE-2026-8921?: Informational severity, with a CVSS score of 8.5, published 3 July 2026.
Which products and versions are affected?: ASUS Business Manager v3.0.38.0 and earlier.
Is there a fix for CVE-2026-8921?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8921 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-8921?: Check whether you run ASUS Business Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as External Control of File Name or Path (CWE-73) exists in ASUS Business Manager versions up to and including v3.0.38.0. The flaw is triggered when the application improperly handles Inter-Process Communication (IPC) messages, allowing a local user with low privileges to manipulate file paths or names. By sending a tampered IPC message, an attacker can achieve arbitrary code execution with SYSTEM-level privileges. ASUS has addressed this in their security advisory, and users are encouraged to update to the latest version of the software.

Affected products

ASUS ASUS Business Manager v3.0.38.0 and earlier

Timeline

2026-07-03: advisory: NVD publication date

References

https://www.asus.com/security-advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.