ZeroDay Findings
Sign inSign up

Findings

CVE-2026-19397

ZDI-26-657: ASUS Control Center Express Agent Missing Authentication Remote Code Execution Vulnerability

Published Sep 10, 2026

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ASUS Control Center Express Agent. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19397.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 10, 2026 · Catalog

    Detected

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of ASUS Control Center Express Agent. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19397.

Sources

  • CVE.orgCVE-2026-19397

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-19397

    30-day exploitation probability 0.2%

    first.org
  • Zero Day InitiativeZDI-26-657

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of ASUS Control Center Express Agent. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19397.

    zerodayinitiative.com