Loading story…
Eye Security disclosed CVE-2026-75754, a critical unauthenticated remote-code-execution chain affecting ASUS Control Center through version 4.0.0.2. The chain exposed an encryption key, provided access to an Apache Guacamole servlet, and included a hardcoded root-password hash; an attacker could use Guacamole to SSH to localhost, bypass the appliance firewall, crack the root credential, and execute commands as root. ASUS released a patched version after disclosure. The researchers said Claude Opus 4.5 aided reverse engineering and exploit development, while human researchers identified and completed the exploitation path.
Separately, a researcher alleged that GPT-5.6-assisted analysis uncovered an unauthenticated WordPress exploit chain involving REST Batch API validation desynchronization, SQL injection in the posts REST endpoint, administrator-account creation, and eventual code execution through plugin upload. The reported chain relies on cache poisoning and WordPress customization and hook behaviors to elevate privileges and replay requests. No CVE, vendor advisory, fixed version, or confirmed patch was provided, so the WordPress findings remain unverified.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
WordPress introduced the REST Batch API in version 5.6. The later alleged exploit chain targets the Batch API endpoint at /wp-json/batch/v1.
After receiving the vulnerability report, ASUS released a patched version of ASUS Control Center for CVE-2026-75754.
Researchers identified CVE-2026-75754, a CVSS 10.0 chain affecting ASUS Control Center through version 4.0.0.2. The chain exposed an encryption key and Guacamole access, allowing an attacker to reach localhost SSH, authenticate as root using a cracked hardcoded-password hash, and execute commands as root.
A researcher alleged that a default WordPress installation using MySQL could be compromised without authentication by chaining Batch API request-validation desynchronization, SQL injection, cache poisoning, temporary administrator authority, and administrator-account creation. The report provides no CVE, vendor advisory, fixed version, or confirmed patch.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
research.eye.security
Open sourceslcyber.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ASUS released an urgent update for ASUS Control Center Enterprise (ACC) to remediate **CVE-2026-75754**, a maximum-severity vulnerability rated CVSS 4.0 `10.0`. The flaw chains missing authentication, server-side request forgery (SSRF), exposure of an encryption key, and embedded credentials, allowing an unauthenticated remote attacker to gain root-level control of an ACC server. Compromise of an ACC instance could give an attacker administrative control over centrally managed servers, PCs, and workstations. ACC versions through `4.0.0.2` are affected; ASUS advises updating to version `3.1.0.9` or later. Organizations unable to patch immediately should isolate ACC management interfaces, restrict SSH traffic on TCP port `2222`, and investigate unexpected SSH listeners.
Sep 6, 2026
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation, including two **WordPress Core** flaws that can be chained from SQL injection to unauthenticated remote code execution, the critical **Langflow** RCE `CVE-2026-0770`, and **DD-WRT** flaw `CVE-2021-27137`. The WordPress issues, `CVE-2026-60137` and `CVE-2026-63030`, affect default installations and have drawn warnings from CERT-FR and NCSC-NL because public proof-of-concept code is available and broader exploitation is considered likely or imminent. `CVE-2026-60137` stems from improper sanitization of the `author__not_in` parameter in `WP_Query` when plugins or themes pass untrusted input, affecting WordPress `6.8.x` before `6.8.6`, `6.9.x` before `6.9.5`, and `7.0.x` before `7.0.2`. Organizations were urged to prioritize patching those versions, update Langflow, and upgrade DD-WRT builds older than `45724`; where immediate WordPress patching is not possible, defenders were advised to restrict unauthenticated access to the REST batch API endpoint, including paths such as `/wp-json/batch/v1` or requests containing `rest_route=/batch/v1`.
Jul 25, 2026
ASUS has released firmware and software updates for seven vulnerabilities across ASUSWRT routers and several Windows components, led by **CVE-2026-13385**, a critical router flaw rated **CVSS 9.5**. The issue affects CN SKU ASUS routers using the UU feature and, according to ASUS advisories, could let a machine-in-the-middle attacker spoof the update server and execute arbitrary commands without credentials; other reporting describes the bug as stemming from improper input validation in router management components and affecting firmware branches including `3.0.0.4_386`, `3.0.0.4_388`, and `3.0.0.6_102`. Successful exploitation could give attackers control of edge devices, enabling traffic interception, malware deployment, and broader network compromise. The broader advisory set also covers flaws in **ASUS System Control Interface v3**, **ASUS Business Manager**, **Aura Wallpaper Service**, **GameSDK**, and router web interfaces, with impacts including physical memory access, information disclosure, denial of service, unauthorized file operations, credential exposure, and data tampering. ASUS said none of the vulnerabilities are confirmed to be under active exploitation and that no public proof-of-concept is known for the critical router issue, but urged customers to apply updates immediately, disable remote administration or affected router features if patching is delayed, restrict management access to trusted IP ranges, use strong credentials, and replace end-of-life routers no longer supported after March 2026.
Jul 22, 2026