Vulnerability · Published Feb 25, 2026 · Assigned by ASUSTOR1

CVE-2026-3100An improper certificate validation vulnerability was found in the FTP Backup on the ADM.

High 8.3

In plain English

A high-severity improper certificate validation in ADM from ASUSTOR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)0.2%top 90.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper validated TLS/SSL certificates allows a remote attacker can intercept network traffic to perform a Man-in-the-Middle (MitM) attack, which may intercept, modify, or obtain sensitive information such as authentication credentials and backup data. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51.

Affected products (as reported)

Vendor	Product	Versions
ASUSTOR	ADM	4.1.0 – through 4.3.3.ROF15.0.0 – through 5.1.2.RE51

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://www.asustor.com/security/security_advisory_detail?id=53 vendor-advisory