Format String Vulnerability in ADM from Asustor
CVE-2026-67244

8.6HIGH

Key Information:

Vendor

Asustor Inc.

Status
Adm
Vendor
CVE Published:
30 July 2026

What is CVE-2026-67244?

A format string vulnerability exists in the Notification OAuth settings of Asustor's ADM. This flaw arises from the handling of user-controlled notification configuration input through a vulnerable format string operation. If exploited by an authenticated administrator, this vulnerability can enable the disclosure of sensitive memory information or lead to denial of service conditions within the affected component. Users of ADM versions from 4.1.0 to 4.3.3.RUN1 and 5.0.0 to 5.1.3.RI81 are particularly at risk.

Affected Version(s)

ADM Linux 5.0.0 <= 5.1.3.RI81

ADM Linux 4.1.0 <= 4.3.3.RUN1

References

https://www.asustor.com/security/security_advisory_detail...
vendor-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt) from Nanjing University of Posts and Telecommunications
.