CVE-2026-18759: ASUSTOR ABP/AES Privilege Escalation Flaw

CVE-2026-18759 Overview

CVE-2026-18759 is a local privilege escalation vulnerability affecting ASUSTOR Backup Plan (ABP) and ASUSTOR EZSync (AES). The background service runs as NT AUTHORITY\SYSTEM and exposes a file-based inter-process communication (IPC) channel protected by AES encryption. The encryption key file is readable by standard users and protected only with DPAPI, so any authenticated local user can recover it. Attackers forge valid IPC requests containing directory traversal sequences to perform arbitrary file reads and writes as SYSTEM. This maps to [CWE-269] Improper Privilege Management.

Critical Impact
Any authenticated local user can escalate to NT AUTHORITY\SYSTEM by forging encrypted IPC requests with path traversal payloads.

Affected Products

ASUSTOR Backup Plan (ABP) 2.0.7.10171 and earlier
ASUSTOR EZSync (AES) 1.1.1.3113 and earlier
Windows hosts running the affected background service as SYSTEM

Discovery Timeline

2026-08-04 - CVE-2026-18759 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18759

Vulnerability Analysis

The ABP and AES background services run as NT AUTHORITY\SYSTEM and accept commands from lower-privileged client processes over a file-based IPC channel. Requests are serialized to disk and encrypted with AES to prevent tampering. The design trusts any client that can produce a correctly encrypted message, without verifying the caller's identity. Because destination paths are validated using an insufficient substring check, attackers bypass the intended directory restrictions with traversal sequences such as ..\. The service then reads or writes arbitrary files with SYSTEM privileges.

Root Cause

Two defects combine to produce the vulnerability. First, the AES key material is stored in a file readable by standard users and protected only by DPAPI under the current user context, so any local authenticated user can decrypt it. Second, the IPC handler performs authorization based on the ability to encrypt a message rather than on the SID of the requesting process. Path validation relies on a substring comparison that does not canonicalize the target before checking allowed directories.

Attack Vector

A local authenticated attacker reads the key file, uses DPAPI to unwrap the AES key, and constructs an IPC request specifying a destination path containing ..\ traversal sequences. The privileged service decrypts the request, passes the substring check, and performs the file operation as SYSTEM. Arbitrary file write to locations such as service binaries, scheduled task definitions, or DLL search paths yields code execution as SYSTEM. Arbitrary file read exposes SAM, SYSTEM hives, and other sensitive material. See the Asustor Security Advisory #70 for vendor technical details.

Detection Methods for CVE-2026-18759

Indicators of Compromise

Access to the ABP or AES IPC key file by non-installer user accounts on Windows endpoints.
New or modified files under privileged directories (C:\Windows\System32\, service install paths) with the ABP or AES service process as the writer.
Child processes spawned by the ABP or AES background service that are not part of normal backup or sync operations.

Detection Strategies

Hunt for file writes by the ABP or AES service to paths outside its documented working directories, which indicates traversal exploitation.
Correlate standard user process reads of the AES key file with subsequent SYSTEM-level file modifications on the same host.
Alert on unexpected DPAPI unwrap operations targeting the ABP or AES key blob outside installer or update workflows.

Monitoring Recommendations

Enable Windows object access auditing on the ABP and AES installation directories and key files.
Forward Sysmon Event IDs 1, 11, and 13 to a central data store to reconstruct the process and file activity chain.
Baseline the expected file operations of the ABP and AES services and alert on deviations.

How to Mitigate CVE-2026-18759

Immediate Actions Required

Upgrade ABP to a version later than 2.0.7.10171 and AES to a version later than 1.1.1.3113 as published in the vendor advisory.
Restrict interactive and remote logon rights on hosts running the affected services until patches are applied.
Audit endpoints for the presence of ABP or AES and inventory installed versions.

Patch Information

ASUSTOR published fixed builds and remediation guidance in Asustor Security Advisory #70. Apply the vendor-supplied updates for ABP and AES on every Windows host where the software is installed. Confirm the service binary version after patching to verify remediation.

Workarounds

Uninstall ABP or AES on Windows systems where backup or sync functionality is not required.
Remove read permissions to the IPC key file for standard users where operationally feasible until patches are deployed.
Stop and disable the ABP or AES background service on hosts pending remediation.

bash

# Configuration example: stop and disable the affected services on Windows
sc.exe stop "ASUSTOR Backup Plan"
sc.exe config "ASUSTOR Backup Plan" start= disabled
sc.exe stop "ASUSTOR EZSync"
sc.exe config "ASUSTOR EZSync" start= disabled