CVE-2026-18759 is an improper authentication vulnerability (CWE-287) in ASUSTOR Inc.'s ABP and AES products. The affected background service runs with SYSTEM privileges and uses AES-encrypted file-based IPC. However, the encryption key file is readable by standard users and protected only by DPAPI, allowing any authenticated local user to recover the key and forge IPC requests. The service does not authenticate the requesting process and performs insufficient validation on destination paths, permitting directory traversal attacks. Exploiting these flaws enables arbitrary file reads and writes as SYSTEM, leading to full local privilege escalation. Affected versions include ABP 2.0.7.10171 and earlier and AES 1.1.1.3113 and earlier. The CVSS 4.0 score is 8.5 (high severity). No patch or remediation information is currently available.

An authenticated local attacker can recover the IPC encryption key and forge requests to the background service running as SYSTEM. Due to lack of proper authentication and insufficient path validation, the attacker can perform arbitrary file read and write operations with SYSTEM privileges. This results in full local privilege escalation, allowing the attacker to execute code or modify system files with the highest privileges on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local user access to prevent unauthorized users from exploiting this vulnerability. Monitor for updates from ASUSTOR Inc. regarding official patches or mitigations.