Auth bypass in Asustor Inc. Abp
CVE-2026-18759
The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protect…
Vulnerability class: Privilege Escalation
Affected products
- Asustor Inc. Abp — versions ABP 2.0
- Asustor Inc. Abp And Aes — versions ABP 2.0, AES 1.0
- Asustor Inc. Aes — versions AES 1.0
Weakness classification (CWE)
References
- security@asustor.com (vendor-advisory)