CVE-2026-9789

High

Description

A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authenticated local user to connect and send commands. Because the service does not check the caller's privileges before running file deletion commands, a low-privileged local user can exploit this to delete arbitrary files with system authority.

SeverityHigh

CVSS8.5

Exploit probability—

ProductNitrorSense V3

PublishedMay 28, 2026

First seenMay 28, 2026

Weakness typeCWE-22Path traversal CWE-269Improper privilege management CWE-284Improper access control CWE-732CWE-732

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
Acer NitrorSense V3	3.01.3001 ≤ v ≤ 3.01.3052	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.