CVE-2026-18759

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the key and forge valid IPC requests. Furthermore, the service does not check the identity of the requesting process and validates destination paths using an insufficient substring check. A local attacker can submit crafted encrypted requests containing directory traversal sequences to perform arbitrary file reads and arbitrary file writes as NT AUTHORITY\SYSTEM, leading to full local privilege escalation. Affected products and versions include: ABP (ASUSTOR Backup Plan) 2.0.7.10171 and earlier as well as AES (ASUSTOR EZSync) 1.1.1.3113 and earlier.

• CWE-269
• CWE-287

• https://www.asustor.com/security/security_advisory_detail?id=70

Published

Aug 4, 2026

Last Modified

Aug 4, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18739A flaw was found in popt, a command-line option parsing libr…2.5
• CVE-2026-1874Always-Incorrect Control Flow Implementation vulnerability i…7.5
• CVE-2026-1875Improper Resource Shutdown or Release vulnerability in Mitsu…7.5
• CVE-2026-18753The product firmware contains an embedded, static RSA privat…9.1
• CVE-2026-18754The product firmware contains an embedded, static RSA privat…9.1
• CVE-2026-18755A DLL hijacking vulnerability in GeoVision GV-ASManager allo…7.3
• CVE-2026-1876Improper Resource Shutdown or Release vulnerability in Mitsu…7.5
• CVE-2026-18766A flaw has been found in chetans9 core-php-admin-panel up to…6.3
• CVE-2026-1877The Auto Post Scheduler plugin for WordPress is vulnerable t…6.1
• CVE-2026-18770A vulnerability has been found in vibesurf-ai VibeSurf up to…7.3
• CVE-2026-18772Improperly controlled sequential memory allocation vulnerabi…6.5
• CVE-2026-18773A vulnerability was detected in NousResearch hermes-agent up…6.3