CVE-2026-18759
Received Received - Intake

Arbitrary File Read/Write in ASUSTOR Backup Plan

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: ASUSTOR, Inc.

Description
The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the key and forge valid IPC requests. Furthermore, the service does not check the identity of the requesting process and validates destination paths using an insufficient substring check. A local attacker can submit crafted encrypted requests containing directory traversal sequences to perform arbitrary file reads and arbitrary file writes as NT AUTHORITY\SYSTEM, leading to full local privilege escalation. Affected products and versions include: ABP (ASUSTOR Backup Plan) 2.0.7.10171 and earlier as well as AES (ASUSTOR EZSync) 1.1.1.3113 and earlier.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-18759
EUVD
EUVD-2026-52640

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
asustor abp to 2.0.7.10171 (exc)
asustor aes to 1.1.1.3113 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a background service running as NT AUTHORITY\SYSTEM on ASUSTOR devices. It uses a file-based encrypted communication method where the encryption key is accessible to standard users and protected by DPAPI. An attacker can exploit this to forge requests, bypassing authentication. The service also fails to properly validate file paths, allowing directory traversal attacks. This enables arbitrary file reads and writes with SYSTEM privileges, leading to local privilege escalation.

Detection Guidance

Check for installed versions of ABP (ASUSTOR Backup Plan) 2.0.7.10171 or earlier and AES (ASUSTOR EZSync) 1.1.1.3113 or earlier. Inspect running services for background processes running as NT AUTHORITY\SYSTEM with file-based IPC mechanisms.

Impact Analysis

If you use ASUSTOR devices with ABP 2.0.7.10171 or earlier or AES 1.1.1.3113 or earlier, an attacker with local access could exploit this to read or write arbitrary files on your system with the highest privileges. This could allow them to install malware, steal sensitive data, or take full control of your device.

Mitigation Strategies

Update ABP to versions later than 2.0.7.10171 and AES to versions later than 1.1.1.3113. Restrict local user access to encryption key files and review service configurations to enforce process identity validation and strict path checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart