Skip to content
OpenAdvisories
High · 8.5 Public exploit CVE-2026-9789 EUVD-2026-32700GHSA-pcjv-vg43-2hf7

NitroSense V3: Security Vulnerability Information

Published May 28, 2026 · Updated May 28, 2026 · Assigned by Acer

Vendor: Acer Product: NitrorSense V3

Description

A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authenticated local user to connect and send commands. Because the service does not check the caller's privileges before running file deletion commands, a low-privileged local user can exploit this to delete arbitrary files with system authority.

Affected products

VendorProductAffectedFixed
Acer NitrorSense V3 3.01.3001 – ≤ 3.01.3052 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • ugvxb/CVE-2026-9789 ★ 0 · May 30, 2026

    A critical local privilege escalation vulnerability has been discovered in Acer NitroSense software (PSAdminAgent.exe). The vulnerability allows any authenticated local user to delete arbitrary files…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References