PULSE
LIVE34signals / 24h
ES
FEED
ransomchaos reclama a remco.ca · CA · Otherransomqilin reclama a Contacto Garantido · MX · Professional Servicesransomqilin reclama a Universitatea de Vest „Vasile Goldiș” din Arad · RO · Educationransomm3rx reclama a hydraulic-components.net · DE · Manufacturingransomm3rx reclama a createinfor.pt · PT · Professional Servicesransomm3rx reclama a servicebypremier.com · US · Professional Servicesransomexfilsquad reclama a Analog Devices · US · Technologyransomexfilsquad reclama a Bonava · SE · Manufacturingransomexfilsquad reclama a City of Atlanta · US · Government & Defenseransomexfilsquad reclama a City of Houston · US · Government & Defenseransomexfilsquad reclama a Viavi Solutions · US · Technologyransomexfilsquad reclama a Newcastle University · GB · Educationransomexfilsquad reclama a District of Columbia Public Schools · US · Educationransomexfilsquad reclama a Zenith Bank Plc · NG · Financial Servicesransomchaos reclama a remco.ca · CA · Otherransomqilin reclama a Contacto Garantido · MX · Professional Servicesransomqilin reclama a Universitatea de Vest „Vasile Goldiș” din Arad · RO · Educationransomm3rx reclama a hydraulic-components.net · DE · Manufacturingransomm3rx reclama a createinfor.pt · PT · Professional Servicesransomm3rx reclama a servicebypremier.com · US · Professional Servicesransomexfilsquad reclama a Analog Devices · US · Technologyransomexfilsquad reclama a Bonava · SE · Manufacturingransomexfilsquad reclama a City of Atlanta · US · Government & Defenseransomexfilsquad reclama a City of Houston · US · Government & Defenseransomexfilsquad reclama a Viavi Solutions · US · Technologyransomexfilsquad reclama a Newcastle University · GB · Educationransomexfilsquad reclama a District of Columbia Public Schools · US · Educationransomexfilsquad reclama a Zenith Bank Plc · NG · Financial Services
← All CVEs
CVE WatchJul 21, 2026

CVE-2026-7480

An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privi

CVSS

—

No CVSS

EPSS

0.1%

p3

KEV

—

Exploit Today

1

0-100

Published: May 29, 2026 · Last modified: Jul 21, 2026 · CWE-732

EPSS · 30d
0.1%EPSS · 30 days0.1%
2026-06-302026-07-25
Technical description

An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and execute arbitrary code via a crafted RPC call that bypass the validation mechanism. Refer to the 'Security Update for ASUS System Control Interface' section on the ASUS Security Advisory for more information.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-618928.8 HIG
19.6%
——6Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.2dCVE-2026-625196.3 MED
16.4%
——5Vulnerability in the Oracle Succession planning product of Oracle E-Business Suite (component: Succession plan). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Succession planning. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Succession planning accessible data as well as unauthorized read access to a subset of Oracle Succession planning accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Succession planning. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).3dCVE-2026-611869.4 CRI
30.4%
——9Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as unauthorized read access to a subset of Oracle Agile Engineering Data Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H).3dCVE-2026-611559.1 CRI
36.8%
——11Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Guided Search Platform Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search Platform Services. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).3dCVE-2026-606597.1 HIG
2.5%
——1Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).2dCVE-2026-633587.3 HIG
1.6%
——0FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.4d