The vulnerability CVE-2026-12962 in ASUS Armoury Crate arises from a permissive cross-domain security policy that accepts requests from untrusted domains. This can be exploited remotely without privileges or user interaction beyond visiting a malicious webpage, which causes the application to send a request containing a UNC path to its local service endpoint. This leads to disclosure of the local user's NTLM hash. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, but requiring user interaction. No known exploits are reported in the wild. No vendor advisory or patch information is currently available.

An attacker can remotely obtain the NTLM hash of a local user by convincing the user to visit a malicious webpage. This hash disclosure could potentially be used in further attacks such as credential replay or lateral movement within a network. The vulnerability does not require privileges or pre-existing access but does require user interaction (visiting a crafted webpage).

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. No official fix or workaround information is currently available. Users should exercise caution when visiting untrusted websites and monitor vendor communications for updates.