Acer vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-50610 A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a High 7.4 · Sep 17, 2026
• CVE-2026-50609 A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense.High 7.4 · Sep 17, 2026
• CVE-2026-50605 A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense.High 7.4 · Sep 17, 2026
• CVE-2026-50602 A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background sHigh 8.5 · Aug 16, 2026
• CVE-2026-50225 The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.High 8.8 · Jun 4, 2026
• CVE-2026-50214 The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plCritical 9.3 · Jun 4, 2026
• CVE-2026-50213 The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification sHigh 8.7 · Jun 4, 2026
• CVE-2026-50212 Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of serHigh 7.1 · Jun 4, 2026
• CVE-2026-50211 Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAMHigh 8.8 · Jun 4, 2026
• CVE-2026-50209 Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to Critical 9.3 · Jun 4, 2026
• CVE-2026-50208 High-risk TrustAllCerts routines disable standard TLS certificate validation.Critical 9.2 · Jun 4, 2026
• CVE-2026-50207 The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectivHigh 8.5 · Jun 4, 2026
• CVE-2026-50206 Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.High 8.5 · Jun 4, 2026
• CVE-2026-50205 System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.High 8.8 · Jun 4, 2026
• CVE-2026-49203 Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.High 7.2 · Jun 4, 2026
• CVE-2026-49202 Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-sitHigh 8.8 · Jun 4, 2026
• CVE-2026-49194 The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interfacCritical 9.4 · Jun 4, 2026
• CVE-2026-49193 Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.High 8.7 · Jun 4, 2026
• CVE-2026-49191 The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.Critical 9.3 · Jun 4, 2026
• CVE-2026-49190 The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or coCritical 9.4 · Jun 4, 2026
• CVE-2026-49189 Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.High 8.5 · Jun 4, 2026
• CVE-2026-49188 The ai_cmd utility executes with full root permissions.High 8.7 · Jun 4, 2026
• CVE-2026-49187 The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.High 8.7 · Jun 4, 2026
• CVE-2026-49186 The local MQTT broker does not enforce topic-level Access Control Lists (ACLs).High 8.6 · Jun 4, 2026
• CVE-2026-49185 The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.Critical 10 · Jun 4, 2026