Which versions of ASUSTOR ADM are affected by CVE-2026-18187?

ASUSTOR ADM storage appliances (versions 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81) contain a memory disclosure vulnerability in the backup component with no public exploit identified at time of…

How to fix or mitigate CVE-2026-18187?

Within 24 hours: Inventory all ASUSTOR ADM deployments, identify affected versions (4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81), audit administrative user accounts, and remove unnecessary backup administrator privileges. Within 7 days: Implement monitoring and alerting for abnormal backup service behavior (process crashes, high memory usage), review backup task logs for suspicious patterns, and restrict administrative access to personnel requiring it for business operations. Within 30 days: Contact ASUSTOR support to confirm patch availability and upgrade timeline; if patching is not immediately feasible, evaluate disabling the Internal Backup component in favor of external backup solutions and schedule patching as a priority upgrade.

ASUSTOR ADM CVE-2026-18187

Q: What is the CVSS score of CVE-2026-18187?

CVE-2026-18187 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50954 HIGH

Use of Externally-Controlled Format String (CWE-134)

2026-07-30 security@asustor.com

GHSA-88cp-j82v-8ffq

Denial Of Service Data Master Asustor

7.1

CVSS 4.0 · Vendor: asustor

Severity by source

Vendor (asustor) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable CGI with low-privilege auth (PR:L), no user interaction; format string yields limited memory disclosure (C:L) and process crash (A:H), no integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (asustor).

CVSS VectorVendor: asustor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 03:30 vuln.today

CVE Published

Jul 30, 2026 - 03:16 cve.org

HIGH 7.1

DescriptionCVE.org

A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an error response and processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected CGI process. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

AnalysisAI

Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81) allow an authenticated attacker to abuse a format string flaw in the Internal Backup component. Because user-controlled task input is echoed into an error response and passed to an unsafe format string operation, the attacker can leak process memory or crash the handling CGI process. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

ADM (ASUSTOR Data Master) is the Linux-based operating system that powers ASUSTOR network-attached storage (NAS) appliances; the affected surface is the Internal Backup feature, which is served through a CGI process in ADM's web management stack. The root cause is CWE-134 (Use of Externally-Controlled Format String): user-supplied task input is passed directly as the format argument to a printf-family function rather than being handled as a data operand of a fixed format specifier. When an attacker embeds conversion specifiers (e.g. %x, %s, %n) in that input, the C library interprets them against the process call stack, enabling reads of adjacent memory or invalid dereferences that terminate the process.

RemediationAI

Upgrade ADM to a fixed release above the affected ranges (later than 4.3.3.RUN1 on the 4.x line and later than 5.1.3.RI81 on the 5.x line) as published in the ASUSTOR advisory at https://www.asustor.com/security/security_advisory_detail?id=67; an exact fixed build number was not included in the provided data, so confirm it against that advisory before deploying. Because exploitation requires an authenticated session, the most effective compensating control until patching is to restrict who can reach the ADM web interface and the Internal Backup feature: remove or disable unnecessary low-privilege accounts, avoid exposing the ADM management interface to the internet (place it behind a VPN or restrict source IPs by firewall), and limit access to the Internal Backup functionality to trusted administrators. The trade-off of locking down the management interface is reduced remote administrative convenience, and disabling accounts may disrupt legitimate backup workflows, so validate these controls against operational needs.