CVE-2026-49197: Acer Predator Connect w6x Firmware

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.

Affected products

• Acer Predator Connect w6x Firmware: up to and including w6x_gbl_2.00.000005

Published 2026-05-29. Last modified 2026-07-21.