Which versions of ASUSTOR ADM are affected by CVE-2026-18188?

ASUSTOR ADM NAS backup systems (versions 4.1.0-4.3.3 and 5.0.0-5.1.3) contain a format string vulnerability in the Rsync Backup component allowing authenticated users to steal sensitive data from…

How to fix or mitigate CVE-2026-18188?

Within 24 hours: Identify and catalog all ASUSTOR ADM instances running affected versions 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81, restrict NAS management interface credentials to administrators with demonstrated operational need, and review recent backup configuration changes and system logs for suspicious activity. Within 7 days: Implement network-level access controls to limit management interface connectivity to specific administrative IP addresses or VLANs, and audit administrative account privileges to eliminate unnecessary access rights. Within 30 days: Continuously monitor ASUSTOR vendor security advisories for patch release; upon patch availability, validate in non-production environment, then deploy to all affected production systems within 48 hours.

ASUSTOR ADM CVE-2026-18188

Q: What is the CVSS score of CVE-2026-18188?

CVE-2026-18188 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50950 HIGH

Use of Externally-Controlled Format String (CWE-134)

2026-07-30 security@asustor.com

GHSA-v869-q27w-qhm7

Denial Of Service Data Master Asustor

7.1

CVSS 4.0 · Vendor: asustor

Severity by source

Vendor (asustor) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable management interface with low-privilege authenticated account gives AV:N/AC:L/PR:L; memory leak is partial confidentiality (C:L), no integrity impact, and backup-component crash is A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (asustor).

CVSS VectorVendor: asustor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 03:32 vuln.today

CVE Published

Jul 30, 2026 - 03:16 cve.org

HIGH 7.1

DescriptionCVE.org

A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data may be processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory information or cause denial of service of the affected backup component. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

AnalysisAI

Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81) arise from an unsafe format string operation in the Rsync Backup component, where user-controlled backup configuration or log data reaches a format function without a fixed format specifier. An authenticated attacker on the NAS management interface can leak process memory contents or crash the backup component. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

ADM (ASUSTOR Data Master) is the Linux-based operating system that runs on ASUSTOR network-attached storage (NAS) appliances; the affected functionality is its integrated Rsync Backup feature, used to schedule and log file synchronization jobs. The root cause is CWE-134 (Use of Externally-Controlled Format String): attacker-influenced values from the rsync backup configuration or log entries are passed directly as the format argument to a C printf-family function rather than being passed as a data argument to a constant format string. Format specifiers such as %x, %s, or %n embedded in that input are then interpreted, allowing stack/heap memory to be read out (via %x/%s) or the process to be crashed via invalid memory access.

RemediationAI

Patch available per vendor advisory: upgrade ADM to a fixed release above the affected ranges (later than 4.3.3.RUN1 on the 4.x branch and later than 5.1.3.RI81 on the 5.x branch) as directed in the ASUSTOR security advisory at https://www.asustor.com/security/security_advisory_detail?id=67 - an exact patched build number was not included in the provided data and should be confirmed against that advisory before deployment. Until patched, reduce exposure by removing the NAS management and Rsync Backup interfaces from the public Internet and restricting them to trusted management VLANs or VPN (side effect: remote administrators must connect through the VPN), and tighten account controls so only trusted, strongly-authenticated users hold ADM accounts, since exploitation requires an authenticated (PR:L) session. If the Rsync Backup feature is not in use, disabling it removes the vulnerable code path at the cost of losing rsync-based backup scheduling.