QNAP QSA-26-10: Multiple Injection and Memory-Safety Vulnerabilities in QTS, QuTS hero, QuTS cloud, QVP, and File Station (CVE-2025-66273, CVE-2026-26240, and 12 others)
QNAP QSA-26-10 (TL-2026-0901), also tracked as QSA-26-10, is a high-severity software vulnerability scored CVSS 9.1, first published 2026-06-22. It has no confirmed attribution, affects QNAP QTS, references 14 CVEs (CVE-2025-66273, CVE-2025-66279, CVE-2026-22893), maps to 15 MITRE ATT&CK techniques (T1005, T1059, T1068), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-0901
- Threat ID
- TL-2026-0901
- Also known as
- QSA-26-10
- Severity
- HIGH
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-06-22
- Last reviewed
- 2026-06-22
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, small-medium-business, managed-service-providers, media-and-entertainment, healthcare, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
QNAP advisory QSA-26-10 (April 6, 2026) patches 14 vulnerabilities across the QTS, QuTS hero, QuTS cloud, and QVP NAS operating systems and the File Station 5/6 applications, spanning OS command injection (CWE-78), stack-based buffer and integer overflows (CWE-121/CWE-190), NULL pointer dereference (CWE-476), incorrect authorization (CWE-863), uncontrolled resource consumption (CWE-770), and password-reset URL injection (CWE-472). QNAP rated the set 'Important'; NVD later scored two File Station buffer overflows (CVE-2026-26240/CVE-2026-26241) CRITICAL 9.1 and several command-injection flaws HIGH (CVSS v4.0 8.6).
How QNAP QSA-26-10 works
On April 6, 2026 QNAP published security advisory QSA-26-10 ('Vulnerabilities in QTS, QuTS hero, QuTS cloud, and QVP'), disclosing 14 CVEs that it had already remediated. The bundle affects the core NAS operating systems — QTS 5.2.7, QuTS hero h5.2.8, QuTS cloud c5.2.8, and the QVP (QVR Pro appliance) line 2.7.1 — as well as the File Station 5 and File Station 6 web file-management applications. QNAP assigned an overall 'Important' severity. When NVD published the records on June 9-10, 2026 and assigned metrics on June 17, 2026, individual scores ranged from LOW to CRITICAL, with the two File Station 5 chunked-upload buffer overflows reaching CVSS v3.1 9.1 (CRITICAL).
The most impactful classes are command injection and memory corruption. Three OS command-injection flaws (CVE-2025-66273, CVE-2025-66279, CVE-2026-22893; all CWE-78, CVSS v4.0 8.6 / v3.1 7.2 HIGH) allow a remote attacker who has obtained an administrator account to execute arbitrary OS commands: CVE-2025-66273 injects through the username parameter, CVE-2025-66279 is reachable through user-deletion APIs, and CVE-2026-22893 enables execution with elevated privileges. Because QNAP NAS appliances are frequently exposed to the internet and run privileged daemons, command injection from an admin context is effectively full device takeover.
The memory-safety set centers on the utilRequest.cgi CGI handler and File Station upload paths. CVE-2025-62858 is a stack overflow (CWE-121, v3.1 6.5) reachable by a remote admin to corrupt memory or crash processes. CVE-2025-66280 is an integer overflow/wraparound (CWE-190/CWE-121, v3.1 7.2 HIGH) that an admin can use to compromise system security. CVE-2025-68405 (not yet in NVD; per the advisory) is a stack overflow exploitable by an authenticated admin to cause a DoS. CVE-2026-26239 is a File Station 5 stack-based buffer overflow (CWE-121, v3.1 8.1 HIGH) usable by an authenticated user. CVE-2026-26240 and CVE-2026-26241 are File Station 5 stack-based buffer overflows (CWE-121, v3.1 9.1 CRITICAL) triggered by overly long upload filenames — including during chunked uploads — that overflow buffers in / crash utilRequest.cgi.
The availability and access-control set includes CVE-2025-66281 (NULL pointer dereference, CWE-476, v3.1 7.2) where malformed HTTP requests missing a Content-Length header crash the service; CVE-2026-22899 (NULL pointer dereference in File Station 6, CWE-476, v3.1 6.5) where a low-privileged user triggers a segmentation fault in utilRequest.cgi for DoS; CVE-2026-24724 (incorrect authorization / broken access control in File Station 6, CWE-863, v3.1 8.1 HIGH) letting an authenticated user bypass intended restrictions and reach sensitive files; and CVE-2026-24720 (uncontrolled resource consumption in File Station 6, CWE-770, v3.1 6.5) where an authenticated user exhausts CPU/memory to deny service. CVE-2025-59382 is a URL-injection flaw (CWE-472, external control of an assumed-immutable web parameter, v4.0 1.2 LOW) in a password-reset flow: a remote attacker can modify the password-reset URL to direct a victim to an attacker-controlled reset page, enabling credential theft via social engineering; NVD notes QTS/QuTS hero/QuTScloud themselves are not affected for this specific item, indicating it applies to an associated component bundled into the advisory.
No threat actor, in-the-wild exploitation, or public proof-of-concept code was reported in either the QNAP advisory or the NVD records; most flaws require a valid (often administrator) account, which constrains pre-authentication risk except for the resource-exhaustion and NULL-dereference DoS items. The pragmatic exposure is that QNAP devices are a recurring ransomware target (DeadBolt, Qlocker, eCh0raix historically), so chained credential compromise plus these command-injection and access-control bugs materially raises takeover risk. Defenders should apply the fixed builds immediately (QTS 5.2.9.3410 build 20260214 / branch 5.2.10, QuTS hero h5.2.9, QuTS cloud c5.2.9, QVP 2.8.0, File Station 5 5.5.6.5243+, File Station 6 fixed build), remove internet exposure of the admin UI, and monitor utilRequest.cgi and File Station for crashes, oversized filenames, and malformed requests.
MITRE ATT&CK techniques used in TL-2026-0901
Collection
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Lateral Movement
T1210 Exploitation of Remote Services
Defense Evasion
T1211 Exploitation for Stealth
Credential Access
T1212 Exploitation for Credential Access
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1499 Endpoint Denial of Service
Reconnaissance
Affected products and versions in QNAP QSA-26-10
- QNAP — QTS
Vulnerable versions: 5.2.7; 5.2.0.2737 - 5.2.9.3409
Fixed in: 5.2.9.3499; 5.2.10; 5.2.9.3410 build 20260214 - QNAP — QuTS hero
Vulnerable versions: h5.2.8; h5.2.0 - h5.2.9.3409; h5.3.0 - h5.3.4.3499; h6.0.0.3324 - h6.0.0.3458
Fixed in: h5.2.9; h5.3.4.3500 build 20260520; h6.0.0.3397 build 20260206 - QNAP — QuTS cloud
Vulnerable versions: c5.2.8
Fixed in: c5.2.9 - QNAP — QVP (QVR Pro appliances)
Vulnerable versions: 2.7.1
Fixed in: 2.8.0 - QNAP — File Station 5
Vulnerable versions: < 5.5.6.5208; < 5.5.6.5243
Fixed in: 5.5.6.5208; 5.5.6.5243 - QNAP — File Station 6
Vulnerable versions: affected build per QSA-26-10
Fixed in: fixed build per QSA-26-10
Remediation for QNAP QSA-26-10
Patches
- QSA-26-10: QTS 5.2.9.3499 / build 20260214+
- QSA-26-10: QuTS hero h5.2.9 / h5.3.4.3500 build 20260520 / h6.0.0.3397 build 20260206
- QSA-26-10: QuTS cloud c5.2.9
- QSA-26-10: QVP 2.8.0
- QSA-26-10: File Station 5 5.5.6.5243+, File Station 6 fixed build
Immediate actions
- Update QTS to 5.2.9.3499 / 5.2.10 (fixed build 5.2.9.3410 build 20260214 or later) via Control Panel > System > Firmware Update
- Update QuTS hero to h5.2.9 (and h5.3.4.3500 build 20260520+ / h6.0.0.3397 build 20260206+ for newer branches)
- Update QuTS cloud to c5.2.9 and QVP to 2.8.0
- Update File Station 5 to 5.5.6.5243 or later and File Station 6 to the fixed build via the App Center
- Remove the QNAP administration UI and File Station from direct internet exposure; restrict to VPN/LAN
Workarounds
- Block external access to the NAS web management interface until patched
- Disable File Station / external file sharing if not required
- Restrict administrative access to trusted source IPs
Longer-term hardening
- Enforce least privilege: minimize accounts with administrator rights since command-injection flaws require an admin account
- Enable 2-step verification on all administrator accounts and rotate credentials
- Disable port forwarding/UPnP and place NAS behind a firewall with geo/IP allowlisting
- Monitor utilRequest.cgi and File Station processes for crashes, segmentation faults, and oversized-filename uploads
CVEs associated with QNAP QSA-26-10
- CVE-2025-66273
- CVE-2025-66279
- CVE-2026-22893
- CVE-2025-59382
- CVE-2025-62858
CVE-2025-68405- CVE-2026-26239
- CVE-2026-26240
- CVE-2026-26241
- CVE-2025-66280
- CVE-2025-66281
- CVE-2026-24724
CVE-2026-24720CVE-2026-22899
Weaknesses (CWE) in QNAP QSA-26-10
CWE-78, CWE-121, CWE-190, CWE-476, CWE-863, CWE-770, CWE-472
Timeline of QNAP QSA-26-10
- QNAP ships first fixed builds (QTS 5.2.9.3410 build 20260214 and QuTS hero h5.2.9.3410 build 20260214) addressing the QSA-26-10 vulnerabilities
- Cyber Security News reports on the QSA-26-10 bundle, summarizing the command-injection, memory-safety, access-control, and DoS issues
- QNAP publishes security advisory QSA-26-10 disclosing 14 patched vulnerabilities across QTS, QuTS hero, QuTS cloud, QVP, and File Station; rated 'Important'
- Additional fixed build released for the QuTS hero h5.3.x branch (h5.3.4.3500 build 20260520)
- First CVE record (CVE-2025-62858, stack overflow) published to NVD
- Remaining QSA-26-10 CVEs published to the NVD, including the File Station buffer overflows and command-injection flaws
- NVD assigns CVSS v3.1/v4.0 metrics and CWE classifications; CVE-2026-26240 and CVE-2026-26241 scored CRITICAL 9.1, command-injection flaws HIGH (v4.0 8.6)
- Threadlinqs Intelligence documents the QSA-26-10 vulnerability set with full MITRE ATT&CK mapping and detection guidance
Sources cited for QNAP QSA-26-10
- QNAP Security Advisory QSA-26-10: Vulnerabilities in QTS, QuTS hero, QuTS cloud, and QVP
- QNAP Patches Multiple Injection Vulnerabilities
- NVD - CVE-2025-66273 (OS Command Injection, CWE-78)
- NVD - CVE-2025-66279 (OS Command Injection, CWE-78)
- NVD - CVE-2026-22893 (OS Command Injection, CWE-78)
- NVD - CVE-2026-26240 (Stack-based Buffer Overflow, CWE-121, CRITICAL 9.1)
- NVD - CVE-2026-26241 (Stack-based Buffer Overflow, CWE-121, CRITICAL 9.1)
- NVD - CVE-2026-26239 (File Station 5 Buffer Overflow, CWE-121)
- NVD - CVE-2025-62858 (Buffer/Stack Overflow, CWE-121)
- NVD - CVE-2025-66280 (Integer Overflow, CWE-190/CWE-121)
- NVD - CVE-2025-66281 (NULL Pointer Dereference, CWE-476)
- NVD - CVE-2026-24724 (Incorrect Authorization, CWE-863)
- NVD - CVE-2026-24720 (Uncontrolled Resource Consumption, CWE-770)
- NVD - CVE-2026-22899 (NULL Pointer Dereference, CWE-476)
- NVD - CVE-2025-59382 (URL Injection / External Control of Web Parameter, CWE-472)
Threats related to QNAP QSA-26-10
- CVE-2025-62507: Unauthenticated Stack-Based Buffer Overflow RCE in Redis XACKDEL Command
- Microsoft's MDASH AI Scanning Harness Uncovers 16 Windows CVEs, Including Four Critical RCE Flaws in TCP/IP, IKEv2, Netlogon, and DNS
- Pre-Auth Remote Code Execution in Enterprise Network Printer Firmware via Fuzzed Management Protocol (STAR Labs Research)
- Node.js Patches 11 Security Flaws Across v22.23.2, v24.18.1, v26.5.1 (HTTP/2 DoS, Permission Model Bypass, TLS/mTLS Issues)
- Multiple Vulnerabilities in PHP (GovCERT.HK A26-07-52): Phar Symlink DoS, Bundled-libgd GIF Memory Corruption, pgsql SQL Injection, and BCMath Out-of-Bounds Write (CVE-2026-7260, CVE-2026-9672, CVE-2026-17543, CVE-2026-17544)
- CVE-2026-8461 (PixelSmash): Heap Out-of-Bounds Write in FFmpeg libavcodec MagicYUV Decoder
Detection coverage for TL-2026-0901
As of 2026-06-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0901 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.