Acer vulnerabilities and threats

OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.

CVE-2026-50228 is a vulnerability in Acer NitroSense V5 (up to version 5.2.63) where the Electron DevTools endpoint is exposed on localhost TCP port 9993 with Chromium remote debugging enabled. This allows an unauthenticated local attacker to execute JavaScript in the privileged application context, leading to arbitrary code execution.

CVE-2026-50227 is a vulnerability in Acer NitroSense V5 software (up to version 5.2.62) where an unauthenticated local attacker can connect to the MQTT broker via its localhost WebSocket endpoint. This allows invocation of exposed RPC functions, including child_process.execSync(), leading to arbitrary command execution within the application context.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able to access the service and perform unauthorized registry modifications, potentially resulting in local privilege escalation.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service functionality may be possible.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.

CVE-2026-50604 is a medium severity vulnerability in the Acer Agent Service used by NitroSense and PredatorSense. The vulnerability arises because the socket handshake process does not enforce authentication before granting access, potentially allowing unauthorized connections to access restricted functionality. The affected versions are those up to and including 1.2.110.2. There is no indication of known exploits in the wild or an available patch at this time.

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.

CVE-2026-50602 is a high-severity vulnerability in the Acer Planet9 background service caused by incorrect file permissions on an executable. The service runs with SYSTEM privileges, but the executable is writable by non-administrative users. This misconfiguration allows an authenticated local user to modify or replace the executable, potentially leading to arbitrary code execution with SYSTEM privileges upon service start or system reboot.

CVE-2026-50601 is a medium severity vulnerability in the Acer Planet9 desktop application version 2.6.131. It involves the use of a hardcoded read-only API key that allows unauthorized access to internal repositories. Exploiting this flaw could enable an attacker to extract embedded administrative keys and secrets, potentially gaining administrative access to repository infrastructure and modifying software source code. Acer has released an update to address this issue, though explicit patch details are not provided.

A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0. The affected element is the function assertPathAllowed of the file src/Markdownify.ts. Executing a manipulation can lead to symlink following. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links.

The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.

The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN.

The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.

The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings.