CVE-2026-67244CWE-134

CVE-2026-67244

High · published July 30, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
41.9
In the wild
Unconfirmed
What it is

A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may be processed through an unsafe format string operation. An authenticated administrator can exploit this issue to disclose memory information or cause denial of service of the affected component.

Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00499 · 41.9th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2026-07-30T07:16Z
Affected products (2)
ProductVersionsFixed in
asustor/data_master≥ 4.1.0.rhu2, ≤ 4.3.3.run1—
asustor/data_master≥ 5.0.0.ra82, < 5.1.4.rjv25.1.4.rjv2
References (1)
https://www.asustor.com/security/security_advisory_detail?id=67 · [email protected]
EPSS history
Timeline
  • 30 JUL 03:04Z
    A format string vulnerability was found in the Notification OAuth settings of ADM
    cvelistv5