CVE-2026-6644

A command injection vulnerability was found in the PPTP VPN Clients on the ADM

Critical9.4EPSS 1.9%

Published: 20 Apr 2026
Updated: 30 Apr 2026
Reserved: 20 Apr 2026
Assigned by: ASUSTOR1

Description

A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to insufficient validation of user-supplied input before it is passed to a system shell. Successful exploitation allows an attacker to achieve Remote Code Execution (RCE) and fully compromise the system. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RR42 as well as from ADM 5.0.0 through ADM 5.1.2.REO1.

Scores

CVSS scores of CVE-2026-6644, by who scored it
Scored by	CVSS	Score	Vector
ASUSTOR1CNA (assigner)	4.0	Critical9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVDNVD · Modified	4.0	Critical9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 1.9% · top 20% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.

Weakness

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

ASUSTOR Inc. · ADM
- affected 4.1.0 – ≤ 4.3.3.RR42
- affected 5.0.0 – ≤ 5.1.2.REO1

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-6644](https://trackcve.app/badge/CVE-2026-6644.svg)](https://trackcve.app/cve/CVE-2026-6644)

Record last updated 30 Apr 2026, 12:48 UTC.