Which versions of ASUSTOR ADM are affected by CVE-2026-18186?

ASUSTOR ADM, a network storage management platform used to control NAS devices, contains a memory disclosure and denial-of-service vulnerability affecting versions 4.1.0-5.1.3.

How to fix or mitigate CVE-2026-18186?

Within 24 hours: Identify all ASUSTOR ADM instances running affected versions (4.1.0-4.3.3.RUN1, 5.0.0-5.1.3.RI81) and disable the FTP Backup feature if not operationally critical. Within 7 days: Audit access controls for FTP Backup configuration, restricting it to trusted administrators only, and review backup and CGI process logs for signs of exploitation or crashes. Within 30 days: Monitor ASUSTOR's security advisory page for a released patch and deploy it immediately upon availability; if a patch timeline is not provided, evaluate alternative backup solutions to reduce exposure duration.

ASUSTOR ADM CVE-2026-18186

Q: What is the CVSS score of CVE-2026-18186?

CVE-2026-18186 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50957 HIGH

Use of Externally-Controlled Format String (CWE-134)

2026-07-30 security@asustor.com

GHSA-5hfx-gvvr-p6xh

Denial Of Service Data Master Asustor

7.1

CVSS 4.0 · Vendor: asustor

Severity by source

Vendor (asustor) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable CGI with low-privilege authentication required (PR:L), no user interaction; partial memory disclosure (C:L), no integrity impact, and process crash drives high availability impact (A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (asustor).

CVSS VectorVendor: asustor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 03:30 vuln.today

CVE Published

Jul 30, 2026 - 03:16 cve.org

HIGH 7.1

DescriptionCVE.org

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected CGI process. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

AnalysisAI

Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81) allow an authenticated attacker to abuse the FTP Backup feature, whose user-controlled backup configuration data is written to a task log and later processed through an unsafe format string operation. Exploitation leaks CGI process memory or crashes the affected CGI process. No public exploit identified at time of analysis and the issue is not on the CISA KEV list; low-privilege authentication is required per the CVSS vector.

Technical ContextAI

ADM is ASUSTOR's Linux-based network-attached-storage (NAS) operating system, and the flaw lives in its web-facing CGI backend that manages FTP Backup jobs. The root cause is CWE-134 (Use of Externally-Controlled Format String): backup configuration values supplied by the user are persisted into a task log and subsequently passed as (or into) a format string argument of a C printf-family function without a fixed format specifier. Attacker-supplied conversion specifiers such as %x/%s/%n are then interpreted by the logging/formatting routine, letting the attacker read adjacent stack or heap memory (information disclosure) or dereference invalid pointers to crash the process. Because the tainted data is stored first and formatted later, this is a stored (second-order) format string rather than a directly reflected one.

RemediationAI

Upgrade ADM to a fixed release above the listed vulnerable ranges (i.e., beyond 4.3.3.RUN1 for the 4.x line and beyond 5.1.3.RI81 for the 5.x line) as directed by the ASUSTOR advisory at https://www.asustor.com/security/security_advisory_detail?id=67 - Patch available per vendor advisory; an exact patched build number is not stated in the supplied data, so confirm the target version directly from that advisory before deploying. Until patched, reduce exposure by restricting who can reach and configure FTP Backup: limit ADM web/administration access to trusted management networks or VPN, avoid exposing the NAS management interface to the internet, and disable or avoid configuring FTP Backup tasks where feasible (trade-off: FTP-based backup jobs will not run). Tightening account privileges so that only fully trusted operators hold accounts capable of editing backup configuration further limits the PR:L attack surface, at the cost of reduced delegated administration.