Stored Format String Vulnerability in FTP Backup for ADM by ASUSTOR
CVE-2026-18186

7.1HIGH

Key Information:

Vendor

Asustor Inc.

Status
Adm
Vendor
CVE Published:
30 July 2026

What is CVE-2026-18186?

A vulnerability in the FTP Backup feature of ASUSTOR's ADM allows an authenticated attacker to exploit user-controlled backup configuration data. This can lead to disclosing sensitive memory information or causing a denial of service for the affected CGI process due to the unsafe handling of format strings in log processing. Administrators are advised to patch affected versions to mitigate potential risks.

Affected Version(s)

ADM Linux 5.0.0 <= 5.1.3.RI81

ADM Linux 4.1.0 <= 4.3.3.RUN1

References

https://www.asustor.com/security/security_advisory_detail...
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt) from Nanjing University of Posts and Telecommunications
.