CVE-2026-67244 ASUSTOR Inc. CVE debrief

Who should care

Defenders responsible for systems with administrator access, particularly those using affected ADM versions, should assess exposure and potential impact. They should prioritize verifying exposure and assessing potential impact, and then plan for remediation efforts, which may include updating affected ADM versions.

Why it matters

CVE-2026-67244 is a format string vulnerability in ADM Notification OAuth settings, allowing authenticated administrators to potentially disclose memory information or cause denial of service. Defenders should prioritize verifying exposure and assessing potential impact, particularly for systems with administrator access.

• Potential memory information disclosure
• Denial of service of the affected component
• Verification of system versions and configurations required
• Remediation efforts necessary to prevent exploitation

Technical summary

The vulnerability occurs in the Notification OAuth settings of ADM, allowing an authenticated administrator to exploit the issue and disclose memory information or cause denial of service. The issue arises from user-controlled notification configuration input being processed through an unsafe format string operation. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81. Defenders should prioritize verifying exposure and assessing potential impact, particularly for systems with administrator access.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, particularly for systems with administrator access. Remediation efforts should focus on updating affected ADM versions.

Recommended defensive actions

• Verify exposure by checking system versions and configurations
• Assess potential impact on systems with administrator access
• Update affected ADM versions to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and CVSS score. The vulnerability occurs in the Notification OAuth settings of ADM, allowing an authenticated administrator to exploit the issue and disclose memory information or cause denial of service. Defenders should verify exposure and assess potential impact, particularly for systems with administrator access. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.