ASUS agent flaw lets nearby users take over logged-in hosts

ASUS has disclosed a vulnerability in Control Center Express Agent, the software component installed on managed machines so they can be administered centrally. According to a GitHub security advisory published on 8 September 2026, tracked as CVE-2026-19397, the agent is missing authentication for a critical function. That means an unauthenticated user who is nearby can connect directly to the agent and control the host, provided the host has an active login session at the time.

The advisory describes the requirements plainly. The attacker does not need credentials for the agent itself. They do need to reach the agent over a direct connection, and they need the target machine to be in a logged-in state. ASUS points administrators to the "Security Update for ASUS Control Center Express Agent" section of its own security advisory for further detail and for the fix.

The published record does not include a severity score, an affected version list, or a patched version number in the text of the GitHub advisory. Nor does it say whether the flaw has been used against real systems. On the information released, this is a disclosed flaw rather than a confirmed incident.

Missing authentication for a critical function is one of the more consequential classes of software defect because there is nothing to bypass. Where a normal attack chain involves stealing a password or a token, here the sensitive function simply answers whoever asks. In the case of a management agent, the functions on offer tend to be the ones an administrator would use, which is why an unauthenticated caller matters more than it would in an ordinary desktop application.

The "nearby user" condition in the advisory limits the exposure, but it should not be read as reassurance on its own. Agents of this kind are usually deployed across whole fleets of office machines, and a single unmanaged network segment, guest network or shared workspace can put an attacker within reach of many hosts at once. The login-session requirement is a real constraint, though during working hours it is a condition that most staff machines meet by default.

Administrators running ASUS Control Center Express should treat the vendor advisory as the authoritative source for affected builds and update instructions, since the GitHub entry defers to it rather than restating the version details. Where updating cannot be done quickly, the practical mitigations follow from the two conditions named in the advisory: restrict which networks can reach the agent's listening service, and shorten the window in which machines sit unattended with an active session.

ASUS has not published, in the material reviewed here, any statement on how the flaw was found or reported. The advisory record lists the issue as reported, with the vendor pointing to a security update.