Is CVE-2026-13585 actively exploited?

No active exploitation of CVE-2026-13585 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-13585 be exploited remotely?

No. CVE-2026-13585 requires local access to exploit.

What is the CVSS score of CVE-2026-13585?

CVE-2026-13585 has a CVSS score of 8.2 (HIGH).

HOME VULNERABILITIESCVE-2026-13585

HIGH

CVE-2026-13585

CWE-226Published: July 15, 2026· Updated: Jul 21, 2026

8.2

CVSS v3.1

EPSS:0.11%probability of exploitation in 30 daysPercentile:1.6th

Official Description

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system.

Refer to the '

Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.

NVD Source

Technical Analysis

CVE-2026-13585 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.High

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X