Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to vulnerabilities
Critical

MDM Endpoint Reassignment via Broadcast Events

IdentifiersCVE-2026-50209CWE-732· Incorrect Permission Assignment…

CVE-2026-50209 describes a local privilege abuse issue in which broadcast events can be used by malicious software to rewrite a device's default Mobile Device Management (MDM) endpoint address. By altering the configured default MDM server address, the vulnerable behavior allows device administrative ownership to be reassigned from the legitimate management authority to an attacker-controlled external endpoint. The available information indicates exploitation is performed by locally present malicious software with low privileges and does not require user interaction. Specific vulnerable functions or components beyond the use of broadcast events are not provided in the available content.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial
ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker to redirect device management communications to an attacker-controlled MDM endpoint and thereby shift effective administrative ownership of the device. This can enable broad compromise of device management trust, including unauthorized policy control, configuration changes, potential access to managed device data, and disruption of legitimate administration. The supplied CVSS v4.0 vector indicates high impact across confidentiality, integrity, availability, and subsequent system impacts.

Mitigation

If you can’t patch tonight, do this now.

If an official fix cannot be applied immediately, mitigation should focus on preventing untrusted local code from sending or abusing the relevant broadcast events and on restricting the ability of low-privileged applications to alter device management configuration. Practical measures include limiting installation of untrusted software, enforcing application allowlisting where possible, monitoring for unauthorized changes to MDM enrollment or endpoint configuration, and validating that devices remain enrolled to the expected management server. The available content does not provide product-specific mitigation steps.

Remediation

Patch, then assume compromise.

The available content does not provide a vendor-issued remediation procedure beyond indicating that the issue is documented by Acer. Remediation should consist of applying the vendor's security update or firmware/software fix that prevents unauthorized modification of the default MDM endpoint via broadcast events. Administrators should consult the referenced Acer advisory or knowledge base article for the specific patched versions and deployment guidance.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
AcerConnect M6E 5G Firmwareoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Start free trial
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES
MITRE CVE
cve.org · CVE-2026-50209
NVD
nvd.nist.gov/vuln/detail/CVE-2026-50209
MITRE CWE · CWE-732
Incorrect Permission Assignment for Critical…
Vendor Advisory
community.acer.com/en/kb/articles/19707