Loading story…
QNAP has patched 14 vulnerabilities across QTS, QuTS hero, QuTS cloud, and QVP that affect NAS and surveillance appliances, with impacts ranging from denial of service and information disclosure to privilege escalation and remote code execution. The vendor’s advisory QSA-26-10 describes multiple bug classes, including command injection, buffer overflow, broken access control, URL injection, NULL pointer dereference, and uncontrolled resource consumption, and rates the issues as Important.
The most serious flaws include command injection vulnerabilities CVE-2025-66273, CVE-2025-66279, and CVE-2026-22893, which can allow arbitrary command execution through username handling or administrative APIs, including one privilege-escalation scenario. QNAP also fixed CVE-2025-59382, a password-reset URL manipulation issue that can expose credentials. Fixed releases include QVP 2.8.0, QuTS cloud C5.2.9, QTS 5.2.9.3499, and QuTS hero h5.2.9; administrators were urged to update immediately, avoid exposing management interfaces to the internet, and maintain snapshots and offline backups because internet-facing NAS devices are frequent ransomware targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On June 24, 2026, a related QNAP security notice was published regarding the vulnerabilities addressed in QSA-26-10. The notice reiterated the importance of applying firmware and security updates promptly.
On June 17, 2026, QNAP released advisory QSA-26-10 covering 14 vulnerabilities affecting QTS, QuTS hero, QuTS cloud, and QVP. The issues included command injection, buffer overflow, broken access control, URL injection, NULL pointer dereference, and uncontrolled resource consumption flaws, and QNAP provided fixed versions for affected product lines.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
QNAP has addressed several security vulnerabilities affecting its License Center application and other NAS tools, which could allow attackers to access sensitive information or disrupt services on affected devices. The vulnerabilities, identified as CVE-2025-52871 (out-of-bounds read) and CVE-2025-53597 (buffer overflow), require an attacker to have access to a valid or administrator account, making credential theft or weak passwords a significant risk factor. QNAP has released patches in License Center 2.0.36 and later, urging organizations and home users to update immediately, especially if their NAS devices are accessible from the internet or shared among multiple users. In addition to the License Center flaws, QNAP also patched high-severity SQL injection and path traversal vulnerabilities in its NAS products. These vulnerabilities could have allowed attackers to execute arbitrary code or access restricted files, further emphasizing the importance of timely updates. Users are advised to access the QTS or QuTS hero management interface and apply the latest security updates to mitigate these risks and protect sensitive data stored on QNAP devices.
Jun 29, 2026
QNAP disclosed two high-severity vulnerabilities affecting its **QVR Pro** and **QuNetSwitch** products that could be exploited remotely without authentication or user interaction. **CVE-2026-22898** is a missing authentication for critical function flaw in QVR Pro, classified as `CWE-306`, that can let remote attackers gain access to the system. QNAP said the issue is fixed in **QVR Pro 2.7.4.14** and later and published advisory **QSA-26-07**. QNAP also addressed **CVE-2026-22897**, a `CWE-78` command injection flaw in **QuNetSwitch** that could allow remote attackers to execute arbitrary commands on vulnerable devices. The company said the bug was fixed in **QuNetSwitch 2.0.4.0415** and later. Both CVE records carry **CVSS v4.0** assessments indicating network-based exploitation with low attack complexity, no required privileges, and no user interaction, making prompt patching a priority for exposed systems.
Jun 29, 2026
QNAP has released security updates to address seven zero-day vulnerabilities in its network-attached storage (NAS) products after these flaws were exploited by security researchers during the Pwn2Own Ireland 2025 competition. The vulnerabilities affected QNAP's QTS and QuTS hero operating systems, as well as key applications including Hyper Data Protector, Malware Remover, and HBS 3 Hybrid Backup Sync. The exploits were demonstrated by teams such as Summoning Team, DEVCORE, Team DDOS, and a CyCraft technology intern, highlighting the critical nature of these security issues. QNAP has provided patched versions for all affected software and strongly recommends that users update to the latest releases and change all passwords to enhance security. The company has published detailed advisories and instructions for updating both the operating systems and vulnerable applications through the QTS or QuTS hero interface. Regular updates and monitoring of product support status are advised to ensure ongoing protection against similar vulnerabilities.
Jun 29, 2026