CVE-2026-18187 is a format string vulnerability in ASUSTOR Inc.'s ADM Internal Backup component. The vulnerability arises because user-controlled task input is included in an error response and processed through an unsafe format string operation. An attacker with authentication privileges can exploit this to disclose memory information or cause denial of service of the CGI process handling the backup tasks. Affected versions include ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation can lead to disclosure of memory information, which may aid further attacks, or cause denial of service of the affected CGI process, disrupting backup functionality. The attacker must be authenticated to exploit this vulnerability. The CVSS 4.0 score of 7.1 reflects a high severity impact with network attack vector, low complexity, no user interaction, and high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor ASUSTOR's advisories for updates. Until a fix is available, restrict access to the affected ADM CGI processes to trusted users only and consider limiting authentication privileges to reduce risk.