CVE-2026-18188 is a format string vulnerability in the Rsync Backup feature of ASUSTOR ADM. The vulnerability is due to unsafe handling of user-controlled input in format string operations, allowing an authenticated attacker to potentially disclose memory contents or cause a denial of service. The affected versions include ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81. The CVSS 4.0 base score is 7.1, indicating a high severity vulnerability with network attack vector, low attack complexity, no user interaction, and high impact on availability.

Exploitation of this vulnerability can lead to disclosure of memory information, which may aid further attacks, or cause denial of service of the Rsync Backup component, impacting backup availability. The attacker must be authenticated to exploit this vulnerability. There is no indication of remote code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the available data. Until a patch is available, restrict access to the Rsync Backup feature to trusted users and monitor for unusual activity related to backup operations.