Local Privilege Escalation in NitroSense by Acer

CVE-2026-9489

What is CVE-2026-9489?

NitroSense versions prior to 3.01.3052 expose a Windows Named Pipe using a custom protocol, which is misconfigured. This allows any authenticated local user to exploit the vulnerability and execute arbitrary code with NT AUTHORITY\SYSTEM privileges. Additionally, an attacker can delete arbitrary files with SYSTEM privileges, significantly compromising the integrity and security of the target system.

References