What is CVE-2026-13585?

CVE-2026-13585 is a vulnerability in ASUS Business Manager, classified under Sensitive Information in Resource Not Removed Before Reuse. Published 2026-07-15.

Is CVE-2026-13585 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in ASUS Business Manager

CVE-2026-13585

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.

EPSS: 0.002 (5.8th percentile) — read the EPSS interpretation.

Affected products

Asus Business Manager — versions 0
Asus System Control Interface — versions 0
Asus System Control Interface V3 — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

416rehman/asus-bsitf-0-day-poc

References

Frequently asked questions

What is CVE-2026-13585?: CVE-2026-13585 is a vulnerability in ASUS Business Manager, classified under Sensitive Information in Resource Not Removed Before Reuse. Published 2026-07-15.
Is CVE-2026-13585 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.