How severe is CVE-2026-8918?

CVE-2026-8918 has a CVSS 4.0 base score of 7.1, rated high severity.

Is CVE-2026-8918 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-8918?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-8918 have an EU (EUVD) identifier?

Yes. CVE-2026-8918 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38205.

When was CVE-2026-8918 published?

CVE-2026-8918 was published on 2026-06-22 and last updated on 2026-06-24.

CVE-2026-8918

CVE-2026-8918 is a high-severity vulnerability with a CVSS 4.0 base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-183.

Key facts

Severity: High (CVSS 4.0 base score 7.1)
EPSS exploit prediction: 0% (13th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-38205
Weakness: CWE-183
Published: 2026-06-22
Last modified: 2026-06-24

Description

A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

Frequently asked questions

What is CVE-2026-8918?: A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
How severe is CVE-2026-8918?: CVE-2026-8918 has a CVSS 4.0 base score of 7.1, rated high severity.
Is CVE-2026-8918 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-8918?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-8918 have an EU (EUVD) identifier?: Yes. CVE-2026-8918 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38205.
When was CVE-2026-8918 published?: CVE-2026-8918 was published on 2026-06-22 and last updated on 2026-06-24.

References

https://www.asus.com/security-advisory

Other CWE-183 vulnerabilities

CVE-2026-3490 — Critical (CVSS 10.0): picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by…
CVE-2026-54316 — Critical (CVSS 9.1): Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved…
CVE-2026-29514 — High (CVSS 8.8): NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the…
CVE-2026-46391 — High (CVSS 8.7): HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version…
CVE-2025-53762 — High (CVSS 8.7): Permissive list of allowed inputs in Microsoft Purview allows an authorized attacker to elevate privileges over a…
CVE-2026-41387 — High (CVSS 7.8): OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in…

Browse all CWE-183 vulnerabilities →