HighPublic exploit

Local Privilege Escalation in Acer NitroSense PSAdminAgent Named Pipe

IdentifiersCVE-2026-9789CWE-732· Incorrect Permission Assignment…

CVE-2026-9789 is a local privilege escalation vulnerability in Acer NitroSense versions prior to 3.01.3052. The issue is in the PSAdminAgent service, which creates a Windows Named Pipe with a weak access control list, allowing any authenticated local user to connect to it. The service accepts commands over that pipe and does not properly validate the caller's privileges before executing file deletion operations. As a result, a low-privileged local user can cause arbitrary file deletion using SYSTEM-level authority.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated low-privileged local user to delete arbitrary files as SYSTEM. This can be leveraged for local privilege escalation, system instability, denial of service, or broader compromise depending on which files are deleted and how the deletion primitive is chained with other techniques.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict local access to affected systems, limit the ability of untrusted users to obtain authenticated local sessions, and review or harden permissions around the PSAdminAgent service where operationally feasible. Monitor for suspicious connections to the PSAdminAgent named pipe and anomalous privileged file deletion activity. Because this is a local issue, reducing multi-user exposure and preventing untrusted code execution on affected hosts lowers risk until the software can be upgraded.

Remediation

Patch, then assume compromise.

Upgrade Acer NitroSense to version 3.01.3052 or later, where the vulnerable behavior is addressed. The fix should ensure the PSAdminAgent named pipe is created with a restrictive ACL and that the service enforces authorization checks on callers before executing privileged file operations.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2026-9789MaturityOperationalVerified exploit

This repository is a small, focused local privilege escalation exploit for CVE-2026-9789 affecting Acer NitroSense/PredatorSense PSAdminAgent.exe on Windows. The repo contains a README with reverse-engineering notes and vulnerability details, plus a single Python exploit script. The exploit is not network-based; it targets a local named pipe exposed by the Acer service. In exploit.py, find_pipe() enumerates \\.\pipe and selects any pipe whose name contains 'predatorsense' or 'nitrosense'. delete_file() then crafts a binary message using command ID 0x0003 and a UTF-16LE encoded attacker-supplied file path, opens the pipe with read/write access via pywin32 CreateFile, writes the payload, reads a response, and closes the handle. The practical capability is arbitrary file deletion as SYSTEM, which can enable privilege escalation indirectly by deleting security controls or protected files. The README states the root cause is an overly permissive named pipe ACL plus lack of path validation and caller authentication in the delete_file handler. Overall, this is a real operational PoC exploit with a hardcoded command format and a user-supplied target path, intended to demonstrate SYSTEM-level arbitrary file deletion through the vulnerable Acer service.

ugvxbDisclosed May 30, 2026markdownpythonlocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

AcerNitrosenseapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

2 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2