AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ASUSCVE-2026-13585

ASUS Business Manager: information disclosure

ASUS

CVE-2026-13585 · Published Jul 15, 2026 · updated Sep 17, 2026

High8.2
No fix yet
ASUS advisory

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system.

Refer to the ' 

Security Update for ASUS System Control Interface  ' section on the ASUS Security Advisory for more information.

Affected versions

PackageAffectedFixed in
Business Manager
Product
<= through v3.0.38.0No fix yet
System Control Interface
Product
<= before v1.1.40.0No fix yet
System Control Interface v3
Product
<= before v3.1.66.0No fix yet
Details and references
CVSS 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-226, CWE-770

More ASUS advisories

All ASUS
High 7.2Jul 15ASUS GameSDK: information disclosureCVE-2026-8919no fix yetHigh 8.5Jul 15ASUS Aura Wallpaper Service: local user could perform file operationsCVE-2026-8920no fix yetHigh 8.4Jul 15ASUS Business Manager: untrusted pointer dereferenceCVE-2026-15029no fix yetMedium 5.6Jul 15ASUS Business Manager: out-of-bounds readCVE-2026-15030no fix yetCritical 9.5Jul 15ASUS Router: improper certificate validationCVE-2026-13385no fix yetMedium 5.9Jul 15ASUS Router: SQL injectionCVE-2026-11851no fix yet