What is the CVSS score of CVE-2026-24936?

CVE-2026-24936 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Data Master are affected by CVE-2026-24936?

A critical vulnerability (CVE-2026-24936, CVSS 9.8) allows unauthenticated attackers to write arbitrary files to systems when a specific Active Directory Domain join feature is enabled in ADM.

How to fix or mitigate CVE-2026-24936?

Within 24 hours: Identify all systems running affected ADM versions with the vulnerable feature enabled and disable the AD Domain join feature immediately; document affected assets. Within 7 days: Implement network segmentation to restrict CGI program access, deploy WAF rules to block malicious input patterns, and establish enhanced monitoring for suspicious file write activities. Within 30 days: Evaluate alternative authentication mechanisms, develop a patch deployment plan for when vendor releases a fix, and conduct security assessment of any potentially compromised systems.

Data Master CVE-2026-24936

CRITICAL

Improper Input Validation (CWE-20)

2026-02-03 security@asustor.com

Code Injection Data Master

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 04:15 nvd

CRITICAL 9.8

DescriptionCVE.org

When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

AnalysisAI

ASUSTOR ADM has an input validation vulnerability when joining AD Domain that allows unauthenticated attackers to compromise the NAS device.

Technical ContextAI

ASUSTOR Data Master (ADM) has a CWE-20 improper input validation vulnerability in the Active Directory Domain join functionality that allows attackers to inject malicious input when the feature is enabled.