CVE-2026-9789: NitroSense V3: Security Vulnerability Information
A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authenticated local user to connect and send commands. Because the service does not check the caller's privileges before running file deletion commands, a low-privileged local user can exploit this to delete arbitrary files with system authority.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Acer NitroSenseto a version that resolves this vulnerability.Fixed in 3.01.3056
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9789?
CVE-2026-9789 has a high severity rating of 8.5.
How do I fix CVE-2026-9789?
To fix CVE-2026-9789, update to NitroSense version V3.01.3056 or later.
What type of vulnerability is CVE-2026-9789?
CVE-2026-9789 is a Local Privilege Escalation (LPE) vulnerability.
What software is affected by CVE-2026-9789?
CVE-2026-9789 affects versions of Acer NitroSense prior to 3.01.3052.
What causes the vulnerability in CVE-2026-9789?
The vulnerability in CVE-2026-9789 is caused by the PSAdminAgent service creating a Named Pipe with a weak Access Control List (ACL).