Critical ASUS Control Center Enterprise Flaw Allows Remote Root Access via CVE-2026-75754
A critical vulnerability tracked as CVE-2026-75754 has been discovered in ASUS Control Center Enterprise (ACC), granting remote attackers complete control over the management server and all administered devices.
The issue carries the maximum CVSS score of 10.0 and results from the combination of three weaknesses: absence of authentication on a critical function, a server-side request forgery (SSRF) vulnerability, and the presence of hardcoded credentials stored directly in the software.
An unauthenticated attacker can send a specially crafted HTTP request to retrieve the encryption key used by the system. Exploitation then activates a local service that opens an SSH interface on TCP port 2222. Using the obtained key together with the product’s fixed credentials, the attacker gains a root shell without requiring any user interaction.
This level of access allows reading, modifying, or deleting any data stored within the ACC platform. Because the solution is deployed to manage servers, PCs, and workstations across an organization, the compromise can quickly spread to additional enterprise assets.
All versions of ASUS Control Center Enterprise up to and including 4.0.0.2 are affected. The vendor published a security bulletin on September 4, 2026, recommending immediate installation of the available update.
Related articles
CISA Sets September 30 Deadline for Federal Agencies to Patch Actively Exploited Citrix NetScaler Zero-Days
CISA has ordered U.S. federal agencies to apply patches by September 30 for two actively exploited zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. The flaws, tracked as CVE-2026-88771 and CVE-2026-88772, enable unauthenticated remote code execution under default configurations and affect systems commonly exposed to the internet. CVE-2026-88771 allows remote code execution without authentication on NetScaler ADC and Gateway, while CVE-2026-88772 can trigger remote code execution or denial of service via a memory overflow when DTLS is enabled on VPN vServers. Citrix has released fixes for versions 14.1 and 13.1, including FIPS and NDcPP builds, with minimum required builds of 14.1-73.37 and 13.1-64.23. The advisory also covers six additional vulnerabilities from CVE-2026-88773 to CVE-2026-88778 involving HTTP request smuggling and TCP ISN prediction issues. Unsupported branches NetScaler 12.1 and 13.0 receive no patches, requiring immediate migration. Organizations are advised to inventory instances, check for compromise indicators before patching, and preserve forensic evidence.
CSRF Flaw in Elementor Allows Admin Account Creation on Over 2 Million WordPress Sites
A critical CSRF vulnerability has been identified in the Elementor page builder plugin for WordPress, affecting versions 4.3.0 and 4.3.1. The issue enables attackers to create administrator accounts on target sites by exploiting improper handling of CSRF protections in the Editor Events module. With a CVSS score of 8.8, the flaw impacts more than 2 million installations out of over 10 million total WordPress sites using the plugin. No CVE identifier had been assigned at the time of disclosure on September 26. The vulnerability was fixed in version 4.3.2, and users are urged to update immediately. The discovery is credited to researcher Saggre following responsible disclosure, with no public records of active exploitation noted at the time of analysis.
Mandiant Uncovers WAF Bypass Campaign Exploiting Critical Oracle PeopleSoft CVE-2026-35273
Mandiant has identified an active campaign abusing CVE-2026-35273, a critical unauthenticated remote code execution flaw in Oracle PeopleSoft's Environment Management Hub (PSEMHUB). Attackers bypass web application firewalls by replacing the literal path /PSEMHUB/ with /%50SEMHUB/, exploiting the fact that many WAF rules inspect the URL before decoding while the PeopleSoft application server decodes it afterward. The exploitation chain relies on Java object deserialization via POST requests to /%50SEMHUB/hub, allowing deployment of two distinct JSP web shells. The group then establishes persistence with a trojanized installer that drops the SIDEEYE backdoor along with Neo-reGeorg and MeshAgent. Activity attributed to UNC6240, linked to ShinyHunters, began as a zero-day against educational institutions in June 2026 and has since expanded to higher education, technology, healthcare, agriculture, transportation, and government sectors.
Dissecting CVE-2026-83557 in jackson-databind: Why Not Every CVE Requires Immediate Panic
A detailed analysis of CVE-2026-83557 reveals that the vulnerability in jackson-databind affects only a narrow set of configurations involving polymorphic deserialization with the Comparable base type. The flaw stems from an incomplete denylist in DefaultBaseTypeLimitingValidator, which overlooks java.lang.Comparable when the MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES flag is explicitly enabled. Researchers constructed working proof-of-concept exploits showing that an attacker can instantiate classes such as java.io.File, but only when the property is declared as Comparable<?> and the protective flag is active. The issue impacts versions 2.11 through 2.22.1, yet the CVSS score of 5.6 reflects its moderate real-world risk because most applications lack the required Comparable-typed polymorphic fields. Patching introduces its own trade-off by blocking legitimate Comparable subclasses, forcing developers to implement custom BasicPolymorphicTypeValidator allowlists. The case highlights how dependency scanners often flag CVEs without considering application-specific configuration and DTO structures.