Which versions of ASUSTOR ADM are affected by CVE-2026-67244?

ASUSTOR ADM NAS appliances (versions 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81) contain a format string vulnerability in Notification OAuth settings that allows authenticated administrators to trigger…

How to fix or mitigate CVE-2026-67244?

Within 24 hours, inventory all ASUSTOR ADM instances to identify those running versions 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81, restrict administrator access to Notification OAuth configuration settings, and review administrative audit logs for recent unauthorized changes. Within 7 days, deploy detection and alerting on administrator modifications to notification settings, and audit all administrative account activities from the past 60 days for suspicious patterns. Within 30 days, implement privileged access management (PAM) for NAS administrative accounts with multi-factor authentication enforcement, establish compensating controls to network-isolate affected appliances, and monitor for ASUSTOR vendor-released patches to versions 4.3.4 or later and 5.1.4 or later.

ASUSTOR ADM CVE-2026-67244

Q: What is the CVSS score of CVE-2026-67244?

CVE-2026-67244 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50953 HIGH

Use of Externally-Controlled Format String (CWE-134)

2026-07-30 security@asustor.com

GHSA-6hj6-9cvx-mc3c

Denial Of Service Data Master Asustor

8.6

CVSS 4.0 · Vendor: asustor

Severity by source

Vendor (asustor) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable ADM UI with low complexity but requires administrator access (PR:H); description supports memory disclosure (C:H) and DoS (A:H) but not integrity impact, so I:N.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (asustor).

CVSS VectorVendor: asustor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 03:33 vuln.today

CVE Published

Jul 30, 2026 - 03:16 cve.org

HIGH 8.6

DescriptionCVE.org

A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may be processed through an unsafe format string operation. An authenticated administrator can exploit this issue to disclose memory information or cause denial of service of the affected component. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

AnalysisAI

Memory disclosure and denial-of-service in ASUSTOR ADM (the NAS operating system) arises from an externally-controlled format string in the Notification OAuth settings, where administrator-supplied notification configuration values are passed into an unsafe format function. An authenticated administrator can submit crafted format specifiers to leak process memory or crash the affected notification component, affecting ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by ASUSTOR's own security team.

Technical ContextAI

ADM (ASUSTOR Data Master) is the Linux-based web-managed operating system that ships on ASUSTOR network-attached storage appliances, exposing a browser administration UI that includes notification integrations such as OAuth-based alert delivery. The flaw is CWE-134 (Use of Externally-Controlled Format String): user-supplied OAuth notification configuration data reaches a C-style formatting routine (e.g., printf/syslog-family functions) as the format argument rather than as a data argument. When an attacker embeds conversion specifiers like %x or %s, the routine reads from the stack/registers or arbitrary pointers, producing memory disclosure; specifiers such as %n or malformed sequences can corrupt state and crash the process. Because the tainted input is administrator-controlled configuration rather than an anonymous network field, exploitation is gated behind the admin authentication layer.

RemediationAI

Upgrade ADM to a build newer than the affected ranges (later than 4.3.3.RUN1 on the 4.x line and later than 5.1.3.RI81 on the 5.x line); the exact fixed version was not included in the provided data, so consult the ASUSTOR advisory at https://www.asustor.com/security/security_advisory_detail?id=67 and apply the vendor-listed patched build for your model - do not rely on an invented version number. As a compensating control until patched, restrict who holds ADM administrator accounts and enforce strong, unique admin credentials plus multi-factor authentication, since exploitation requires administrator privileges; additionally, avoid configuring the OAuth notification feature and remove any untrusted OAuth/notification configuration, which closes the specific input path at the cost of losing OAuth-based alert delivery. Do not expose the ADM administration interface directly to the internet - place it behind a VPN or restrict management access by source IP - which reduces remote reachability with the trade-off of added access friction for remote administrators.