What’s Vulnerable › Vulnerabilities

CVE-2026-13585

• Severity: high (CVSS 8.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-15 · updated 2026-09-17
• Weakness: CWE-226

Description

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system. Refer to the '  Security Update for ASUS System Control Interface  ' section on the ASUS Security Advisory for more information.

Affected products

• ASUS Business Manager: through v3.0.38.0
• ASUS System Control Interface: before v1.1.40.0
• ASUS System Control Interface v3: before v3.1.66.0

References

• https://www.asus.com/security-advisory/
• http://seclists.org/fulldisclosure/2026/Jul/26

Get alerted when CVE-2026-13585 or the next vulnerability affects your stack