ASUS has patched four security flaws in its router firmware and PC software, including one that can let a nearby attacker run commands with root privileges on a home router. The company issued four security alerts on 4 November 2026, and the worst flaw is tracked as CVE-2026-88710, scored 8.7 out of 10.

CVE-2026-88710 is an improper neutralisation of special elements in an operating-system command in certain ASUS router firmware. It allows an unauthenticated nearby user to trigger a chain of actions, including unauthenticated queries, identifier guessing and credential overwriting, ending in command injection and arbitrary code execution with root privileges. The attacker must be nearby on the network, so anyone on the local network, or on a shared network such as a guest Wi-Fi, is in scope.

Three more flaws in the same alerts

The alerts also cover CVE-2026-84730, an 8.7-rated buffer overflow in the router AiCloud tool, CVE-2026-112116, an 8.5-rated access-control flaw in the ASUS System Control Interface driver, and CVE-2026-84729, a 7.2-rated out-of-bounds write in router network services. The System Control Interface flaw affects versions 3.1.66.0 through 3.1.69.0, and the Armoury Crate software flaw affects versions v5.4.10 through v6.5.14.

Which devices need updating

The router flaws affect ASUSWRT firmware series 3.0.0.4_386, 3.0.0.4_388 and 3.0.0.6_102. ASUS has released firmware and software fixes for all affected models, and router owners should install the newest firmware now, then check that automatic updates are switched on. ASUS has confirmed no active exploitation in the wild for these flaws. Owners should also restrict access to the router management interface to trusted networks only, and keep guest networks separate from the devices they use for banking and work. A second report confirms the same four flaws, scores and affected products.