PatchTheCVEasustor vulnerabilities
Recent CVEs affecting asustor products. 8 tracked.
asustor has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2026-07-30. Highest priority: CVE-2026-67248 (score 41/100).
- CVE-2026-67248 HIGH 8.8 UPGRADE A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM
- CVE-2026-18186 HIGH 8.1 UPGRADE A stored format string vulnerability was found in the FTP Backup on the ADM
- CVE-2026-18187 HIGH 8.1 UPGRADE A format string vulnerability was found in the Internal Backup on the ADM
- CVE-2026-18188 HIGH 8.1 UPGRADE A format string vulnerability was found in the Rsync Backup on the ADM
- CVE-2026-67244 HIGH 7.2 UPGRADE A format string vulnerability was found in the Notification OAuth settings of ADM
- CVE-2026-67245 HIGH 8.1 UPGRADE A path traversal vulnerability was found in the VPN Clients on the ADM
- CVE-2026-67246 MEDIUM 6.5 UPGRADE A path traversal vulnerability was found in the Wallpaper component of ADM
- CVE-2026-67247 MEDIUM 6.5 UPGRADE A path traversal vulnerability was found in the IHM Log handling of ADM
FAQ
How do I fix asustor vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is asustor being exploited right now?
None of the tracked asustor CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which asustor CVE should I patch first?
CVE-2026-67248 currently ranks highest (41/100): A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM.