CVE-2026-12962: ASUS Armoury Crate

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

Affected products

• ASUS Armoury Crate: up to and including 6.5.7.0

Published 2026-09-08. Last modified 2026-09-17.