This vulnerability (CVE-2026-67244) is a CWE-134 Use of Externally-Controlled Format String in ASUSTOR ADM's Notification OAuth settings. It occurs because user-controlled notification configuration input is processed through an unsafe format string operation. Exploitation requires authenticated administrator privileges and can lead to memory information disclosure or denial of service of the affected component. Affected versions include ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81. No official patch or remediation level has been published as of the data provided.

An authenticated administrator can exploit this vulnerability to disclose sensitive memory information or cause a denial of service in the affected ADM component. This could impact system stability and confidentiality of information processed by the Notification OAuth settings. There is no indication of remote unauthenticated exploitation or privilege escalation beyond administrator level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, administrators should monitor ASUSTOR's advisories for updates. Until a patch is available, restrict administrator access to trusted personnel and avoid untrusted input in notification configuration settings.