QNAP Patches NAS Vulnerabilities That Could Lead to Command Execution

QNAP has released security fixes for multiple vulnerabilities affecting QTS, QuTS hero, QuTS cloud, and QVP, the firmware used on QVR Pro appliances. The flaws can allow command execution, denial-of-service attacks, broken access control, credential theft, and other security issues on affected NAS systems.

The company detailed the fixes in QNAP security advisory QSA-26-10, which is marked as Important and listed as resolved. The affected products include QTS 5.2.7, QuTS hero h5.2.8, QuTS cloud c5.2.8, and QVP 2.7.1.

The most serious risk comes from command injection flaws that require an authenticated administrator account. If attackers already have admin access, they could exploit some of these issues to run arbitrary system commands on a NAS device.

Command Injection Bugs Carry the Highest Risk

QNAP fixed three command injection vulnerabilities in this advisory: CVE-2025-66273, CVE-2025-66279, and CVE-2026-22893. The first issue involves the username parameter, while the second affects user deletion APIs. Both could let an authenticated administrator execute commands on the device.

CVE-2026-22893 stands out because QNAP says it can allow command execution with elevated privileges. The NVD page for CVE-2026-22893 gives the issue a CVSS 3.1 score of 7.2, rated High, and describes it as a command injection flaw affecting several QNAP operating system versions.

These vulnerabilities do not mean every affected NAS can be taken over without credentials. Several of the most damaging issues require an administrator account or another authenticated user account. However, the risk remains serious in environments where attackers have stolen credentials, reused passwords, exposed login panels, or weak access controls.

Other Flaws Could Crash Services or Expose Data

The advisory also includes memory-handling vulnerabilities that could disrupt NAS services. CVE-2025-62858 and CVE-2025-68405 are stack overflow issues, while CVE-2026-26239, CVE-2026-26240, and CVE-2026-26241 involve stack-based buffer overflows.

Two of those buffer overflow bugs can be triggered through overly long filenames during file upload operations. QNAP says CVE-2026-26240 can crash utilRequest.cgi, while CVE-2026-26241 can be triggered during chunked file uploads and may crash the affected CGI process.

QNAP also fixed CVE-2026-24724, a broken access control vulnerability that could let an authenticated user bypass intended restrictions and access sensitive files. Another issue, CVE-2026-24720, can allow an authenticated remote attacker to consume excessive CPU and memory resources, reducing system responsiveness.

Vulnerabilities Fixed in QSA-26-10

CVE	Vulnerability type	Potential impact	Required access
CVE-2025-59382	URL injection	Credential theft through a crafted password reset page	Remote attacker and user interaction
CVE-2025-66273	Command injection	Arbitrary command execution through the username parameter	Authenticated administrator
CVE-2025-66279	Command injection	Arbitrary command execution through user deletion APIs	Authenticated administrator
CVE-2026-22893	Command injection	Command execution with elevated privileges	Authenticated administrator
CVE-2025-62858	Stack overflow	Memory corruption and unexpected system behavior	Remote administrator
CVE-2025-68405	Stack overflow	Denial-of-service condition	Authenticated administrator
CVE-2026-26239	Stack-based buffer overflow	Unauthorized actions	Authenticated user
CVE-2026-26240	Stack-based buffer overflow	Service crash through an overly long upload filename	Authenticated user
CVE-2026-26241	Stack-based buffer overflow	CGI process crash during chunked file uploads	Authenticated or unauthenticated remote attacker
CVE-2026-24724	Broken access control	Access to sensitive files	Authenticated user
CVE-2026-22899	NULL pointer dereference	Denial-of-service condition in utilRequest.cgi	Authenticated low-privileged user
CVE-2026-24720	Uncontrolled resource consumption	High CPU and memory usage	Authenticated remote attacker
CVE-2025-66280	Stack manipulation	Unexpected behavior or denial of service	Authenticated administrator
CVE-2025-66281	Pre-authentication NULL pointer dereference	Denial-of-service condition through a malformed HTTP request	Remote attacker

Fixed Versions for Affected QNAP Products

QNAP says it has already fixed the vulnerabilities across the affected product lines. Administrators should compare their installed firmware against the fixed versions and update immediately if they are still running an affected release.

Affected product	Affected version listed by QNAP	Fixed version listed by QNAP
QTS	QTS 5.2.7	QTS 5.2.9.3499
QuTS hero	QuTS hero h5.2.8	QuTS hero h5.2.9
QuTS cloud	QuTS cloud c5.2.8	QuTS cloud C5.2.9
QVP	QVP 2.7.1	QVP 2.8.0

The official QSA-26-10 advisory recommends regular system updates so devices receive vulnerability fixes. QNAP also points users to the QNAP Download Center for manual firmware updates when live updates are not used.

How Administrators Should Respond

Organizations using QNAP NAS devices should prioritize this update because NAS systems often store backups, shared files, surveillance data, and business documents. A successful compromise can give attackers access to valuable data or a foothold inside the network.

Administrators can update QTS, QuTS hero, or QuTS cloud by logging in as an administrator, opening Control Panel, going to System, and selecting Firmware Update. From there, they can use Live Update to check for and install the latest available firmware.

For QVP appliances, administrators should download the correct firmware package, upload it through the firmware update tab, and start the update from the device interface. The Download Center should be used only after confirming the exact model and firmware branch.

• Update QTS, QuTS hero, QuTS cloud, and QVP to the fixed versions or later.
• Restrict NAS management access to trusted networks or VPN users.
• Review administrator accounts and remove unused or shared credentials.
• Enable multi-factor authentication where available.
• Check logs for unusual login attempts, failed authentication, and unexpected file activity.
• Avoid exposing NAS administration panels directly to the internet.

Why This Update Matters

QNAP NAS devices have long been attractive targets because they often hold large amounts of business and personal data. Even when a flaw requires authentication, stolen or reused credentials can turn that condition into a practical attack path.

This advisory also combines several different bug classes in one update. Command injection can lead to direct system-level impact, memory bugs can crash services, and access control flaws can expose files that should remain restricted.

For home users, small businesses, and enterprises, the safest approach is the same: install the patched firmware, reduce management exposure, and treat NAS accounts as high-value credentials.

FAQ