# CVE-2026-8921: ASUS Business Manager privilege escalation via tampered IPC message

Source: https://junglewise.ai/threats/cve-2026-8921-asus-business-manager-privilege-escalation-via-tampered-ipc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-8921 · Severity: info · CVSS 8.5 · Published 2026-07-03

ASUS Business Manager, a software suite used for managing business PCs, contains a security flaw that allows a local user to gain full control over the computer. By sending a specially crafted message to the software, an attacker can execute commands with the highest level of system privileges. This could lead to a total compromise of the device, including unauthorized access to all data and the ability to disable security features.

Technologies: [ASUS Business Manager](https://junglewise.ai/threats/technologies/business-manager). Vendors: [ASUS](https://junglewise.ai/threats/vendors/asus).

## Quick answers

**Is CVE-2026-8921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8921 being exploited in the wild.

**How severe is CVE-2026-8921?** Informational severity, with a CVSS score of 8.5, published 3 July 2026.

**Which products and versions are affected?** ASUS Business Manager v3.0.38.0 and earlier.

**Is there a fix for CVE-2026-8921?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8921 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-8921?** Check whether you run ASUS Business Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as External Control of File Name or Path (CWE-73) exists in ASUS Business Manager versions up to and including v3.0.38.0. The flaw is triggered when the application improperly handles Inter-Process Communication (IPC) messages, allowing a local user with low privileges to manipulate file paths or names. By sending a tampered IPC message, an attacker can achieve arbitrary code execution with SYSTEM-level privileges. ASUS has addressed this in their security advisory, and users are encouraged to update to the latest version of the software.

## Affected products

- ASUS ASUS Business Manager v3.0.38.0 and earlier

## Timeline

- 2026-07-03: advisory: NVD publication date

## References

- [https://www.asus.com/security-advisory](https://www.asus.com/security-advisory)

## Related threats

- [ASUS System Control Interface out-of-bounds read via IOCTL](https://junglewise.ai/threats/cve-2026-15030-asus-system-control-interface-out-of-bounds-read-via-ioctl)
- [ASUS System Control Interface and Business Manager Information Disclosure and DoS](https://junglewise.ai/threats/cve-2026-13585-asus-system-control-interface-and-business-manager-information)