What is the CVSS score of CVE-2026-24936?

CVE-2026-24936 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-24936?

Within 24 hours: Identify all systems running affected ADM versions with the vulnerable feature enabled and disable the AD Domain join feature immediately; document affected assets. Within 7 days: Implement network segmentation to restrict CGI program access, deploy WAF rules to block malicious input patterns, and establish enhanced monitoring for suspicious file write activities. Within 30 days: Evaluate alternative authentication mechanisms, develop a patch deployment plan for when vendor releases a fix, and conduct security assessment of any potentially compromised systems.

Data Master CVE-2026-24936

CRITICAL

Improper Input Validation (CWE-20)

2026-02-03 security@asustor.com

Code Injection Data Master Asustor

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted HTTP request to vulnerable CGI program
Delivery

Bypass input validation in AD Domain join function
Exploit

Write arbitrary data to system files
Execution

Overwrite critical system files
Impact

Achieve complete system compromise

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	ASUSTOR ADM version 4.1.0-4.3.3.ROF1 or 5.0.0-5.1.1.RCI1 with AD Domain join function enabled. No authentication required; remote unauthenticated exploitation against default network-accessible ADM instances.
Impact	CVSS 9.8 — NAS devices store large amounts of data. Compromise of the ADM management interface gives access to all stored files and network shares.
Exploit ScenarioDerived	An attacker exploits the input validation flaw during AD domain operations to inject commands or malicious data, gaining control of the ASUSTOR NAS and access to all stored files.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

ASUSTOR ADM has an input validation vulnerability when joining AD Domain that allows unauthenticated attackers to compromise the NAS device.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:54 CVSS 9.8

Input validation flaw in ASUSTOR ADM AD Domain join enables NAS compromise.

RemediationAI

Update ADM firmware. Restrict network access to NAS management interfaces.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

ASUSTOR Data Master (ADM) has a CWE-20 improper input validation vulnerability in the Active Directory Domain join functionality that allows attackers to inject malicious input when the feature is enabled.

Know when Data Master gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

Executive ViewAI

Why It Matters

A critical vulnerability (CVE-2026-24936, CVSS 9.8) allows unauthenticated attackers to write arbitrary files to systems when a specific Active Directory Domain join feature is enabled in ADM. This could enable complete system compromise, data exfiltration, or lateral movement across the enterprise domain infrastructure. Organizations using this feature face immediate risk of unauthorized access and potential business disruption.

Business Impact: Severe

Compensating Controls

Disable the specific AD Domain join feature in ADM until patch availability; implement network-level access controls restricting CGI program exposure; deploy Web Application Firewall (WAF) with input validation rules blocking arbitrary file write attempts; enable enhanced file system monitoring and integrity checking (e.g., HIDS/SIEM rules); restrict ADM administrative access to trusted networks only; consider air-gapping or isolating affected systems if business-critical.

Threat Intelligence Overview

EPSS Score

0.1%

Top 69% exploitable

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.