# CVE-2026-67244: ASUSTOR ADM format string vulnerability in Notification OAuth settings

Source: https://junglewise.ai/threats/cve-2026-67244-asustor-adm-format-string-vulnerability-in-notification-oauth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-67244 · Severity: info · CVSS 8.6 · Published 2026-07-30

ASUSTOR Data Master (ADM), the operating system for ASUSTOR NAS devices, contains a security vulnerability in its notification settings. An administrator with existing access to the system can exploit this flaw to crash the device or potentially view sensitive information stored in the system's memory. This could lead to service interruptions or the exposure of internal system data.

Technologies: [ASUSTOR ADM](https://junglewise.ai/threats/technologies/adm). Vendors: [ASUSTOR](https://junglewise.ai/threats/vendors/asustor).

## Quick answers

**Is CVE-2026-67244 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67244 being exploited in the wild.

**How severe is CVE-2026-67244?** Informational severity, with a CVSS score of 8.6, published 30 July 2026.

**Which products and versions are affected?** ASUSTOR ADM 4.1.0 - 4.3.3.RUN1, 5.0.0 - 5.1.3.RI81.

**Is there a fix for CVE-2026-67244?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67244 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-67244?** Check whether you run ASUSTOR ADM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A format string vulnerability (CWE-134) exists in the Notification OAuth settings of ASUSTOR ADM. The flaw is caused by the unsafe processing of user-controlled notification configuration input through a format string operation. An authenticated attacker with administrative privileges can provide specially crafted input to trigger the vulnerability. Successful exploitation can lead to the disclosure of sensitive memory contents or a denial of service (DoS) condition by crashing the affected component. The vulnerability impacts ADM versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81.

## Affected products

- ASUSTOR ADM 4.1.0 - 4.3.3.RUN1, 5.0.0 - 5.1.3.RI81

## Timeline

- 2026-07-30: advisory

## References

- [https://www.asustor.com/security/security_advisory_detail?id=67](https://www.asustor.com/security/security_advisory_detail?id=67)

## Related threats

- [ASUSTOR ADM HTTP header injection in start-page-loader.cgi](https://junglewise.ai/threats/cve-2026-105324-an-http-header-injection-vulnerability-in-start-page-loader-cgi)
- [ASUSTOR ADM stack buffer overflow in File Explorer](https://junglewise.ai/threats/cve-2026-67248-asustor-adm-stack-buffer-overflow-in-file-explorer)
- [ASUSTOR ADM path traversal in IHM Log handling](https://junglewise.ai/threats/cve-2026-67247-asustor-adm-path-traversal-in-ihm-log-handling)
- [ASUSTOR ADM path traversal in Wallpaper component](https://junglewise.ai/threats/cve-2026-67246-asustor-adm-path-traversal-in-wallpaper-component)
- [ASUSTOR ADM path traversal in VPN Clients](https://junglewise.ai/threats/cve-2026-67245-asustor-adm-path-traversal-in-vpn-clients)