CVE-2026-9489
Last modified
CVE-2026-9489 is a high-severity vulnerability rated 8.5/10 on the CVSS scale. NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. EPSS estimates a 0.12% chance of exploitation in the next 30 days.
Description
NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges.
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Acer | NitrorSense V3 | >= 3.01.3001, <= 3.01.3052 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-9489?
How severe is CVE-2026-9489?
How do I fix CVE-2026-9489?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9482A vulnerability has been found in Edimax EW-7438RPn 1.31. Th…8.8
- CVE-2026-9483A vulnerability was found in SourceCodester Student Grades M…6.3
- CVE-2026-9484A vulnerability was determined in SourceCodester Student Gra…6.3
- CVE-2026-9485A vulnerability was identified in SourceCodester Student Gra…3.5
- CVE-2026-9486A security flaw has been discovered in SourceCodester Studen…4.3
- CVE-2026-9487XML::Sig versions before 0.71 for Perl allow signature wrapp…9.1
- CVE-2026-9490A security vulnerability has been identified in Acer Care Ce…5.5
- CVE-2026-9492The MBStorage DRAM lighting control module within Gigabyte C…8.5
- CVE-2026-9493Service Center developed by BankPro E-Service Technology has…7.1
- CVE-2026-9494An information disclosure vulnerability exists in Canonical …5.5
- CVE-2026-9495Versions of the package @koa/router from 14.0.0 and before 1…7.3
- CVE-2026-9496Versions of the package pacote from 11.2.7 and before 21.5.1…7.7
Are you affected by CVE-2026-9489?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST