Acer vulnerabilities, page 4
68 vulnerabilities
Known vulnerabilities in Acer products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 79 products.
CVE-2026-50211acerconnect_m6e_5g_firmware+1
EPSS score0.52%
Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.CVE-2026-50604aceragent serviceEPSS score0.21%
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be established, potentially allowing access to functionality that should be restricted.CVE-2026-50603aceragent serviceEPSS score0.10%
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.CVE-2026-50207acerconnect_m6e_5g_firmware+1EPSS score0.18%
The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectivity.CVE-2026-50609acersystem monitoringEPSS score0.13%
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.CVE-2026-50608acersystem monitoringEPSS score0.21%
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service functionality may be possible.CVE-2026-50228acernitrosense v5EPSS score0.13%
An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.CVE-2023-48034acersk-9662_firmwareEPSS score0.25%
An issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to both decrypt wireless keystrokes and inject arbitrary keystrokes via use of weak encryption.