Is CVE-2026-1880 actively exploited?

No active exploitation of CVE-2026-1880 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-1880 be exploited remotely?

No. CVE-2026-1880 requires local access to exploit.

What is the CVSS score of CVE-2026-1880?

CVE-2026-1880 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2026-1880

MEDIUM

CVE-2026-1880

CWE-367Published: April 16, 2026· Updated: Apr 17, 2026

5.4

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.3th

Official Description

An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due to improper protection of required execution resources during the validation phase, permitting a local user to make unprivileged modifications. This allows the altered resource to pass system checks and be executed with elevated privileges upon a user-initiated update.

Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.

NVD Source

Technical Analysis

CVE-2026-1880 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityHigh

Privileges Req.Low

User InteractionP

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X