Loading story…
QNAP disclosed two high-severity vulnerabilities affecting its QVR Pro and QuNetSwitch products that could be exploited remotely without authentication or user interaction. CVE-2026-22898 is a missing authentication for critical function flaw in QVR Pro, classified as CWE-306, that can let remote attackers gain access to the system. QNAP said the issue is fixed in QVR Pro 2.7.4.14 and later and published advisory QSA-26-07.
QNAP also addressed CVE-2026-22897, a CWE-78 command injection flaw in QuNetSwitch that could allow remote attackers to execute arbitrary commands on vulnerable devices. The company said the bug was fixed in QuNetSwitch 2.0.4.0415 and later. Both CVE records carry CVSS v4.0 assessments indicating network-based exploitation with low attack complexity, no required privileges, and no user interaction, making prompt patching a priority for exposed systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
QNAP said the QuNetSwitch command injection flaw tracked as CVE-2026-22897 was fixed in QuNetSwitch version 2.0.4.0415 and later. The vulnerability enables remote attackers to execute arbitrary commands on affected systems.
QNAP disclosed CVE-2026-22898, a missing authentication for critical function vulnerability in QVR Pro that could let remote attackers gain access to the system. The company said the issue was fixed in QVR Pro version 2.7.4.14 and later and published advisory QSA-26-07.
QNAP reported that the QuNetSwitch command injection vulnerability later assigned CVE-2026-22897 was received by security@qnapsecurity.com.tw. The flaw allows remote attackers to execute arbitrary commands on vulnerable systems.
Zero Day Initiative reported a remote code execution vulnerability in the QVRPro Plugin on QNAP TS-453E devices to QNAP. The flaw, later tracked as CVE-2026-22898 and ZDI-CAN-28327, could be exploited by network-adjacent unauthenticated attackers to execute code as the postgres user.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
QNAP has patched 14 vulnerabilities across **QTS**, **QuTS hero**, **QuTS cloud**, and **QVP** that affect NAS and surveillance appliances, with impacts ranging from denial of service and information disclosure to privilege escalation and remote code execution. The vendor’s advisory `QSA-26-10` describes multiple bug classes, including command injection, buffer overflow, broken access control, URL injection, NULL pointer dereference, and uncontrolled resource consumption, and rates the issues as **Important**. The most serious flaws include command injection vulnerabilities `CVE-2025-66273`, `CVE-2025-66279`, and `CVE-2026-22893`, which can allow arbitrary command execution through username handling or administrative APIs, including one privilege-escalation scenario. QNAP also fixed `CVE-2025-59382`, a password-reset URL manipulation issue that can expose credentials. Fixed releases include **QVP 2.8.0**, **QuTS cloud C5.2.9**, **QTS 5.2.9.3499**, and **QuTS hero h5.2.9**; administrators were urged to update immediately, avoid exposing management interfaces to the internet, and maintain snapshots and offline backups because internet-facing NAS devices are frequent ransomware targets.
Jun 29, 2026
QNAP disclosed fixes for two vulnerabilities in the **QHora-322** router after public advisories from Trend Micro's Zero Day Initiative linked the bugs to Pwn2Own research by Bongeun Koo and Evangelos Daravigkas of Team DDOS. One flaw, **CVE-2025-62845** (`ZDI-26-240`), affects the `qvpn_db_mgr` endpoint and allows attackers to bypass **QBelt VPN** authentication through improper neutralization of escape sequences in the `role_type` parameter. The issue was rated **CVSS 6.3**. A second flaw, **CVE-2025-62846** (`ZDI-26-241`), also in `qvpn_db_mgr`, stems from improper validation of user input used to build SQL queries, creating a username SQL injection condition that can lead to **remote code execution as root**. ZDI said exploitation nominally requires authentication, but the product's authentication mechanism can be bypassed, making the bugs especially dangerous when chained. QNAP has released updates to remediate the vulnerabilities, and the RCE issue was assigned a **CVSS 8.8** severity score.
Jun 29, 2026
QNAP has addressed several security vulnerabilities affecting its License Center application and other NAS tools, which could allow attackers to access sensitive information or disrupt services on affected devices. The vulnerabilities, identified as CVE-2025-52871 (out-of-bounds read) and CVE-2025-53597 (buffer overflow), require an attacker to have access to a valid or administrator account, making credential theft or weak passwords a significant risk factor. QNAP has released patches in License Center 2.0.36 and later, urging organizations and home users to update immediately, especially if their NAS devices are accessible from the internet or shared among multiple users. In addition to the License Center flaws, QNAP also patched high-severity SQL injection and path traversal vulnerabilities in its NAS products. These vulnerabilities could have allowed attackers to execute arbitrary code or access restricted files, further emphasizing the importance of timely updates. Users are advised to access the QTS or QuTS hero management interface and apply the latest security updates to mitigate these risks and protect sensitive data stored on QNAP devices.
Jun 29, 2026