CVE-2026-19397: ASUS Control Center Express Agent Unauthenticated RCE (ZDI-26-657) — Detection and Remediation Guide

The Zero Day Initiative has published ZDI-26-657, disclosing a critical missing-authentication vulnerability in the ASUS Control Center Express Agent, tracked as CVE-2026-19397 with a CVSS score of 9.8 (Critical). The flaw allows remote attackers to execute arbitrary code on affected installations without any authentication whatsoever — no credentials, no user interaction, just network reachability to the agent's listening service.

This is the worst-case class of vulnerability for an enterprise management agent. ASUS Control Center Express is deployed to centrally manage fleets of ASUS desktops, workstations, and motherboards in corporate environments. That means the vulnerable component — the endpoint agent — is installed broadly across endpoint estates, typically running with elevated privileges, and is frequently flat-network reachable from user VLANs. An unauthenticated RCE in a management agent is functionally equivalent to handing an attacker a pre-installed remote access trojan on every managed machine: it gives them a SYSTEM-level foothold, lateral movement launch pad, and — because the agent is trusted software — a degree of inherent blind-spot coverage from endpoint tooling that whitelists it.

If your organization runs ASUS Control Center Express, treat this as an emergency change. This post breaks down what we know, how to hunt for exploitation, and how to remediate.

Technical Analysis

Vulnerability Overview

How the Vulnerability Works

ZDI-26-657 is classified as a missing authentication flaw. In practical terms, the ASUS Control Center Express Agent exposes a network-facing service endpoint — used by the management console to push commands, configurations, software, and scripts to managed endpoints — that fails to verify the identity of the connecting party before accepting and acting on requests.

From a defender's perspective, the attack chain looks like this:

1. Discovery: The attacker scans for the agent's listening TCP port (management agents typically bind a fixed or predictable port for console-to-agent communication). Any host with the agent installed responds.
2. Unauthenticated request: The attacker crafts a request to the exposed function — which is intended only for the legitimate management server — with no authentication challenge enforced.
3. Arbitrary code execution: The vulnerable function processes attacker-controlled input in a privileged context. Because management agents execute software installs, scripts, and system commands by design, successful exploitation yields code execution at the agent's privilege level — typically SYSTEM/root-equivalent.
4. Post-exploitation: From SYSTEM on an endpoint, an attacker can dump credentials, disable or tamper with EDR, and pivot laterally. Because the agent is a fleet-wide deployment, a single exploit primitive is reusable across every managed host.

Why This Is Unusually Dangerous

• Fleet-wide blast radius: Management agents are deployed by the hundreds or thousands. One exploit = every endpoint.
• Privileged context: Agents run as SYSTEM to perform software deployment and system management.
• Network exposure: Console-to-agent communication channels are often reachable from any internal subnet, and misconfigurations can expose them beyond that.
• Trust inheritance: Security tooling frequently whitelists management agent processes and their child processes, giving attackers execution paths that evade behavioral detection.

Exploitation Status

At the time of the ZDI-26-657 publication, there is no public confirmation of in-the-wild exploitation and the CVE has not yet been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, ZDI advisories of this class — unauthenticated RCE in widely deployed endpoint software with a 9.8 CVSS — historically attract rapid reverse engineering. The gap between advisory publication and working PoC for missing-authentication bugs is typically measured in days to weeks, not months, because no memory-corruption primitive needs to be developed: the vulnerability is a logic flaw that can often be reproduced directly from the advisory's description of the exposed functionality. Do not wait for a KEV listing to act.

Detection & Response

Hunting for exploitation of a missing-authentication agent RCE centers on two observable behaviors: (1) network connections to the agent's service port from non-console hosts, and (2) the agent process spawning unexpected child processes (command shells, script interpreters, LOLBins) — the signature of code execution through the management channel from an illegitimate source.

Sigma Rules

The following rules target the two highest-fidelity behaviors. Tune the agent process names and your legitimate console server addresses to your environment before deployment.

---
title: ASUS Control Center Agent Spawning Command Shell or Script Interpreter
id: 3f8a1c94-2b7d-4e51-a9f6-0d8c2e5b7a41
status: experimental
description: Detects the ASUS Control Center Express Agent process spawning command shells or script interpreters, consistent with post-exploitation via CVE-2026-19397 unauthenticated remote code execution through the agent's management channel.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-657/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\ASUS\ControlCenter\'
      - '\ASUS Control Center\'
      - 'ACCAgent'
      - 'asus_ac'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate software deployment or scripted tasks pushed by the ASUS Control Center management console during authorized maintenance windows. Correlate with console task logs before escalating.
level: high
---
title: Network Connection to ASUS Control Center Agent Port from Non-Console Host
id: 8c2e5b71-4a9f-4d63-b1e8-7f3a0c6d9e52
status: experimental
description: Detects inbound network connections to the ASUS Control Center Express Agent listening port originating from hosts other than authorized management console servers, indicative of unauthenticated exploitation attempts against CVE-2026-19397.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-657/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.exploitation_of_remote_services
  - attack.t1210
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - '\ASUS\ControlCenter\'
      - '\ASUS Control Center\'
      - 'ACCAgent'
  filter_console:
    SourceIp:
      - '10.0.0.0/8'
  condition: selection and not filter_console
falsepositives:
  - Asset inventory or vulnerability scanners probing the agent port
  - Secondary or standby management consoles not yet added to the filter list
level: medium

Tuning note: Replace the filter_console range with the exact IP addresses of your legitimate ASUS Control Center management servers. A host-scoped allowlist is what converts this from noise into a high-fidelity tripwire — any other source hitting the agent port deserves investigation.

KQL (Microsoft Sentinel / Defender)

This query hunts for the ASUS agent process spawning execution-capable child processes, plus inbound network sessions to the agent from non-allowlisted sources. Deploy as a scheduled analytics rule with a low threshold.

// Hunt 1: ASUS Control Center Agent spawning shells/script interpreters (possible CVE-2026-19397 post-exploitation)
let ConsoleServers = dynamic(["10.10.5.20", "10.10.5.21"]); // Replace with your ASUS Control Center console IPs
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("ASUS", "ControlCenter")
    or InitiatingProcessFileName has_any ("ACCAgent", "asus_ac")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteIP
| order by TimeGenerated desc;

// Hunt 2: Inbound connections to ASUS agent from non-console hosts (possible unauthenticated access attempt)
let ConsoleServers2 = dynamic(["10.10.5.20", "10.10.5.21"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("ASUS", "ControlCenter")
    or InitiatingProcessFileName has_any ("ACCAgent", "asus_ac")
| where ActionType == "InboundConnectionAccepted"
| where not (RemoteIP has_any (ConsoleServers2))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteIP, LocalPort, InitiatingProcessFileName
| order by ConnectionCount desc;

If your environment ingests firewall or syslog data into Sentinel, extend Hunt 2 with a CommonSecurityLog query matching destination ports associated with the agent service and sources outside the console subnet — scanning behavior against the agent port across many hosts is a strong pre-exploitation indicator.

Velociraptor VQL

For DFIR teams validating whether a specific host's agent has been abused, this artifact enumerates agent processes with their network bindings and child processes in one pass.

-- Identify ASUS Control Center Agent processes, their child processes, and active network listeners
LET agent_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(ACCAgent|asus_ac|ControlCenter)'
   OR CommandLine =~ '(?i)(ASUS.*Control.*Center)'

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       netstat() AS Connections
FROM agent_procs

-- Then review child processes of the agent PID for execution artifacts
SELECT Pid, Ppid, Name, CommandLine, Exe, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM pslist()
               WHERE Exe =~ '(?i)(ACCAgent|asus_ac|ControlCenter)')
  AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|wmic|certutil)'

Remediation and Verification Script

Use this PowerShell script to (1) inventory hosts running the ASUS Control Center Express Agent, (2) identify the agent's listening ports and which remote hosts are connected to them, and (3) apply a temporary host firewall restriction so only authorized console servers can reach the agent — a critical compensating control while awaiting the vendor patch.

# CVE-2026-19397 - ASUS Control Center Express Agent exposure audit and interim hardening
# Run elevated on managed endpoints or deploy via GPO/Intune/SCCM

$ConsoleServers = @("10.10.5.20", "10.10.5.21")   # REPLACE with authorized console IPs
$RuleName = "ASUS-ACC-Agent-ConsoleOnly-CVE-2026-19397"

# Step 1: Detect agent installation and running services
Write-Host "=== ASUS Control Center Agent Inventory ===" -ForegroundColor Cyan
Get-Service | Where-Object { $_.DisplayName -match "ASUS|Control Center" } |
    Select-Object Name, DisplayName, Status, StartType | Format-Table -AutoSize
Get-Process | Where-Object { $_.Path -match "ASUS|ControlCenter" } |
    Select-Object Name, Id, Path | Format-Table -AutoSize

# Step 2: Identify agent listening ports and current inbound connections
Write-Host "=== Listening Ports and Inbound Connections ===" -ForegroundColor Cyan
$agentPids = (Get-Process | Where-Object { $_.Path -match "ASUS|ControlCenter" }).Id
foreach ($procId in $agentPids) {
    Get-NetTCPConnection -OwningProcess $procId -ErrorAction SilentlyContinue |
        Select-Object LocalAddress, LocalPort, RemoteAddress, State |
        Format-Table -AutoSize
}

# Step 3: Interim mitigation - restrict inbound access to agent ports to console servers only
# Discover agent listening ports dynamically, then apply scoped firewall rules
$agentPorts = Get-NetTCPConnection -OwningProcess $agentPids -State Listen -ErrorAction SilentlyContinue |
    Select-Object -ExpandProperty LocalPort -Unique
foreach ($port in $agentPorts) {
    $existing = Get-NetFirewallRule -DisplayName "$RuleName-$port" -ErrorAction SilentlyContinue
    if (-not $existing) {
        New-NetFirewallRule -DisplayName "$RuleName-$port" `
            -Direction Inbound -Protocol TCP -LocalPort $port `
            -RemoteAddress $ConsoleServers -Action Allow -Profile Any `
            -Description "Interim mitigation for CVE-2026-19397: restrict agent port $port to authorized consoles only"
        New-NetFirewallRule -DisplayName "$RuleName-$port-BlockAll" `
            -Direction Inbound -Protocol TCP -LocalPort $port `
            -Action Block -Profile Any `
            -Description "Interim mitigation for CVE-2026-19397: block all other inbound access to agent port $port"
        Write-Host "Applied console-only restriction to agent port $port" -ForegroundColor Green
    }
}

# Step 4: Verify - confirm no non-console hosts have active sessions to the agent
Write-Host "=== Suspicious Connections (non-console sources) ===" -ForegroundColor Yellow
Get-NetTCPConnection -OwningProcess $agentPids -State Established -ErrorAction SilentlyContinue |
    Where-Object { $ConsoleServers -notcontains $_.RemoteAddress -and $_.RemoteAddress -notmatch "^(127\.|::1$|0\.0\.0\.0$)" } |
    Select-Object LocalPort, RemoteAddress, State | Format-Table -AutoSize

Remediation

1. Patch immediately. Apply the fixed release of ASUS Control Center Express Agent addressing CVE-2026-19397 as soon as ASUS publishes it. Track the ZDI advisory at ZDI-26-657 and ASUS's security advisory page for the patched version number. ZDI advisories are published when a fix is available or the disclosure timeline has expired — check the vendor's download portal for the updated agent build and push it fleet-wide through your normal software deployment channel (ironically, potentially through ASUS Control Center itself once the server side is updated).

2. Apply network-layer compensating controls now. Until the agent is patched, restrict inbound access to the agent's listening ports so that only authorized management console servers can connect. Use host firewall rules (script above), VLAN ACLs, or your network firewall. This directly neutralizes the exploitation condition — an attacker who cannot reach the service cannot exploit the missing authentication.

3. Inventory your exposure. Identify every host with the Express Agent installed and confirm whether the agent service is reachable from user segments, server segments, guest networks, or — worst case — externally. Query your EDR/software inventory for agent executables and services.

4. Hunt retroactively. Run the KQL and VQL hunts above over the past 30–90 days of telemetry. Missing-authentication bugs leave clean forensic signatures: agent child processes and non-console connections to the agent port. If you find either from unknown sources, treat the host as compromised — capture a memory image and triage for credential theft and persistence before reimaging.

5. Monitor for KEV addition and PoC publication. Set alerting on CVE-2026-19397 in your threat intel feeds. A CISA KEV listing would impose a remediation deadline for federal agencies and should trigger an emergency SLA internally regardless of sector. Expect public exploit code; a 9.8 unauthenticated RCE in a logic flaw is a low-effort reverse-engineering target.

6. Review management-agent architecture long term. This vulnerability class — missing authentication on a management channel — is a design failure, not a coding slip. For ASUS Control Center and every other agent-based management platform in your estate (RMM tools, asset agents, remote support tooling), validate that mutual authentication is enforced on console-to-agent channels, that agent ports are segmented, and that agent child-process behavior is monitored. The next ZDI-26-657 will be a different vendor's agent.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub