Critical Vulnerability in ASUS Control Center Enterprise Allows Remote Root Access Without Authentication
ASUS has issued an urgent advisory regarding a critical vulnerability in its terminal management software ASUS Control Center Enterprise (ACC). The flaw, identified as CVE-2026-75754, enables remote attackers to gain root-level access without any authentication.
The vulnerability arises from multiple interconnected issues, including hardcoded credentials, absence of authentication for key functions, and server-side request forgery (SSRF). These weaknesses allow an attacker to retrieve encryption keys through simple HTTP requests and subsequently activate SSH on TCP port 2222 using the embedded credentials to obtain root access.
Successful exploitation could result in the leakage, alteration, or deletion of data stored on affected devices. In enterprise environments, attackers may also achieve remote control over all managed endpoints within the organization.
ASUS published the security advisory on September 4, 2026, and strongly recommends that all users apply the available updates without delay. No workarounds have been provided, making patching the only effective mitigation.
Related articles
Top 10 Security Stories: Critical Flaws in PaperCut NG/MF, Chrome, WatchGuard and Others Dominate Week
Security NEXT has published its weekly ranking of the ten most-read articles between August 30 and September 5 2026. The list is led by a critical vulnerability in PaperCut NG/MF that is already being exploited in the wild. Google Chrome received two separate updates addressing 38 vulnerabilities, including two rated Critical and one zero-day. WatchGuard Fireware OS, SonicWall SMA 1000, Cisco IOS XR and Apache Tomcat also received urgent patches for severe flaws. Three real-world incidents made the top ten: a customer-data breach at 01 Bank, a ransomware infection at Hands HD and a suspected cloud leak at Corona. The ranking reflects strong reader interest in both newly disclosed vulnerabilities and confirmed exploitation cases.
CVE-2026-85046 Exploited in Chromium V8 Engine, Affecting Chrome, Edge and Other Browsers
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaw resides in the V8 JavaScript engine of Chromium and stems from a type confusion issue that can allow arbitrary code execution inside the sandbox when a crafted HTML page is processed. Google released a patch for Chrome on September 3, 2026, while the vulnerability carries a CVSS v3.1 base score of 8.8 and is rated High severity. Because numerous browsers including Microsoft Edge, Opera, and Vivaldi are built on Chromium, they are potentially exposed until their respective vendors issue updates. Security teams are advised to verify that all Chromium-based browsers in their environments have been updated to the latest versions containing the fix.
Gmail Address Variants Bypass String Comparison and Enable Multiple Registrations
A single user created four separate accounts using valid Gmail address formats that all deliver to the same inbox: Ivan.Petrov@gmail.com, ivanpetrov@gmail.com, ivan.petrov+shop@gmail.com, and IVAN.PETROV@gmail.com. Simple string comparison in the registration code treated these as distinct entries, allowing circumvention of new-user promotions, free-tier limits, and one-application-per-person rules. The root cause lies in three Gmail-specific behaviors: case-insensitive local parts, plus-addressing that ignores everything after the + symbol, and dots that carry no semantic meaning in the local part. Additional risks arise from IDNA homograph domains that visually mimic legitimate addresses but encode to different Punycode strings. Proper mitigation requires storing both the original email for delivery and a domain-aware normalized form for uniqueness checks, combined with explicit IDNA validation on registration.
Dangling DNS Records Expose Companies to Subdomain Takeovers Years After Projects Shut Down
A marketing team requested reactivation of a three-year-old promotional landing page, only to discover that its domain now served an unrelated third-party website. The root cause was a forgotten CNAME record in the company's DNS zone that continued pointing to a project name on external hosting after the original service had been decommissioned. Because many hosting providers use wildcard DNS entries, standard availability checks and simple DNS resolution tests fail to detect that the target project no longer exists. Attackers who re-register the freed project name can then serve content under the company's legitimate subdomain, automatically obtaining valid TLS certificates and inheriting domain-wide cookies. The article details how such dangling records accumulate across infrastructure, marketing, and acquired company zones, and explains the concrete risks including cookie theft, bypass of Content-Security-Policy, and unauthorized domain ownership proofs. It concludes with a practical remediation workflow: export the full zone, assign owners to every record, validate external targets by application response rather than DNS resolution, and embed record removal into decommissioning procedures.