CVE-2026-67244
Received Received - Intake

Format String Vulnerability in ADM Notification OAuth Settings

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: ASUSTOR, Inc.

Description
A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may be processed through an unsafe format string operation. An authenticated administrator can exploit this issue to disclose memory information or cause denial of service of the affected component. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-67244
EUVD
EUVD-2026-50953

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
asustor adm From 4.1.0 (inc) to 4.3.3 (inc)
asustor adm From 5.0.0 (inc) to 5.1.3 (inc)
asustor adm From 4.1.0 (inc) to 4.3.3.RUN1 (inc)
asustor adm From 5.0.0 (inc) to 5.1.3.RI81 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-134 The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a format string vulnerability in the Notification OAuth settings of ADM software. It occurs when user-controlled input in notification configuration is processed through an unsafe format string operation. An authenticated administrator can exploit this to read memory information or cause the affected component to stop working.

Impact Analysis

An attacker with admin access could exploit this to crash the ADM system or leak sensitive memory data. This may lead to service disruption or unauthorized information disclosure on affected systems running vulnerable ADM versions.

Compliance Impact

This vulnerability could lead to unauthorized data access or system downtime, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information if exploited.

Mitigation Strategies

Update ADM to a version outside the affected range (4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81). Specifically, upgrade to ADM 4.3.4.RUN1 or later, or ADM 5.2.0.RI82 or later. Disable OAuth notification settings if not in use until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67244. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart