Vulnerability details
CVE-2026-67244
ASUSTOR ADM
A format string vulnerability was found in the Notification OAuth settings of ADM
CVSS 4.0
8.6High
Official description
A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may be processed through an unsafe format string operation. An authenticated administrator can exploit this issue to disclose memory information or cause denial of service of the affected component. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 4.0 | CVEProject cvelistV5 (CNA) (ASUSTOR1) | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| ASUSTOR Inc. | ADM | 4.1.0 ≤ v ≤ 4.3.3.RUN1 | CVEProject cvelistV5 (CNA) |
| ASUSTOR Inc. | ADM | 5.0.0 ≤ v ≤ 5.1.3.RI81 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://www.asustor.com/security/security_advisory_detail?id=67 vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-30
- Last updated
- 2026-08-04
- State
- Published
- Assigner (CNA)
- ASUSTOR1
Exploit prediction (EPSS)
0.49%
Probability of exploitation in 30 days
43%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-134Use of Externally-Controlled format string