Permissive Cross-domain Security Vulnerability in Armoury Crate by ASUS

CVE-2026-12962

What is CVE-2026-12962?

A security flaw in Armoury Crate allows remote attackers to exploit a permissive cross-domain security policy. By persuading a user to visit a malicious web page, an attacker can gain access to the user's NTLM hash. This is achieved by sending a crafted request containing a UNC path to the local service endpoint of the application. Users of Armoury Crate should refer to the ASUS Security Advisory for important updates and remediation steps.

References