The GIGABYTE Control Center has a vulnerability that allows attackers to access files on affected computers without needing authentication.

The manufacturer states that exploiting this flaw could result in running unauthorized code, gaining higher-level access, or causing a system crash.

The GIGABYTE Control Center (GCC), included with all of GIGABYTE’s laptops and motherboards, is a comprehensive Windows tool for managing and configuring hardware.

It offers features like monitoring hardware, controlling fan speeds, adjusting performance, managing RGB lighting, updating drivers and firmware, and handling device settings.

A “pairing” feature in the Control Center allows it to communicate with other devices or networks. Systems with ‘pairing’ enabled on Control Center version 25.07.21.01 and older are vulnerable.

Taiwan’s CERT has warned that “If the pairing feature is turned on, remote attackers without credentials can place files wherever they want on the system, leading to running harmful code or gaining escalated privileges.”

The vulnerability, known as CVE-2026-4415, was found by security researcher David Sprüngli. Using the CVSS v4.0 scoring system, the problem is considered to have a critical severity rating (9.2 out of 10).

Users should update to the newest Control Center version, 25.12.10.01, which fixes issues with managing download paths, message handling, and encrypting commands to resolve the vulnerability.

The vendor warns, “Customers are highly encouraged to immediately update to the latest GCC version.”

To reduce the risk of downloading compromised installers, it is advisable for GIGABYTE product users to obtain the most recent GCC version from the vendor’s official software portal.

BleepingComputer has contacted GIGABYTE for more information on CVE-2026-4415 but hasn’t received a response as of this publication.