# QNAP QSA-26-10: Multiple Injection and Memory-Safety Vulnerabilities in QTS, QuTS hero, QuTS cloud, QVP, and File Station (CVE-2025-66273, CVE-2026-26240, and 12 others)

> QNAP advisory QSA-26-10 (April 6, 2026) patches 14 vulnerabilities across the QTS, QuTS hero, QuTS cloud, and QVP NAS operating systems and the File Station 5/6 applications, spanning OS command injection (CWE-78), stack-based buffer and integer overflows (CWE-121/CWE-190), NULL pointer dereference (CWE-476), incorrect authorization (CWE-863), uncontrolled resource consumption (CWE-770), and password-reset URL injection (CWE-472). QNAP rated the set 'Important'; NVD later scored two File Station buffer overflows (CVE-2026-26240/CVE-2026-26241) CRITICAL 9.1 and several command-injection flaws HIGH (CVSS v4.0 8.6).

- **Published:** 2026-06-22T00:00:00Z
- **Last reviewed:** 2026-06-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0901
- **ID:** TL-2026-0901
- **Severity:** HIGH (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-66273, CVE-2025-66279, CVE-2026-22893, CVE-2025-59382, CVE-2025-62858, CVE-2025-68405, CVE-2026-26239, CVE-2026-26240, CVE-2026-26241, CVE-2025-66280, CVE-2025-66281, CVE-2026-24724, CVE-2026-24720, CVE-2026-22899

## Description

On April 6, 2026 QNAP published security advisory QSA-26-10 ('Vulnerabilities in QTS, QuTS hero, QuTS cloud, and QVP'), disclosing 14 CVEs that it had already remediated. The bundle affects the core NAS operating systems — QTS 5.2.7, QuTS hero h5.2.8, QuTS cloud c5.2.8, and the QVP (QVR Pro appliance) line 2.7.1 — as well as the File Station 5 and File Station 6 web file-management applications. QNAP assigned an overall 'Important' severity. When NVD published the records on June 9-10, 2026 and assigned metrics on June 17, 2026, individual scores ranged from LOW to CRITICAL, with the two File Station 5 chunked-upload buffer overflows reaching CVSS v3.1 9.1 (CRITICAL).

The most impactful classes are command injection and memory corruption. Three OS command-injection flaws (CVE-2025-66273, CVE-2025-66279, CVE-2026-22893; all CWE-78, CVSS v4.0 8.6 / v3.1 7.2 HIGH) allow a remote attacker who has obtained an administrator account to execute arbitrary OS commands: CVE-2025-66273 injects through the username parameter, CVE-2025-66279 is reachable through user-deletion APIs, and CVE-2026-22893 enables execution with elevated privileges. Because QNAP NAS appliances are frequently exposed to the internet and run privileged daemons, command injection from an admin context is effectively full device takeover.

The memory-safety set centers on the utilRequest.cgi CGI handler and File Station upload paths. CVE-2025-62858 is a stack overflow (CWE-121, v3.1 6.5) reachable by a remote admin to corrupt memory or crash processes. CVE-2025-66280 is an integer overflow/wraparound (CWE-190/CWE-121, v3.1 7.2 HIGH) that an admin can use to compromise system security. CVE-2025-68405 (not yet in NVD; per the advisory) is a stack overflow exploitable by an authenticated admin to cause a DoS. CVE-2026-26239 is a File Station 5 stack-based buffer overflow (CWE-121, v3.1 8.1 HIGH) usable by an authenticated user. CVE-2026-26240 and CVE-2026-26241 are File Station 5 stack-based buffer overflows (CWE-121, v3.1 9.1 CRITICAL) triggered by overly long upload filenames — including during chunked uploads — that overflow buffers in / crash utilRequest.cgi.

The availability and access-control set includes CVE-2025-66281 (NULL pointer dereference, CWE-476, v3.1 7.2) where malformed HTTP requests missing a Content-Length header crash the service; CVE-2026-22899 (NULL pointer dereference in File Station 6, CWE-476, v3.1 6.5) where a low-privileged user triggers a segmentation fault in utilRequest.cgi for DoS; CVE-2026-24724 (incorrect authorization / broken access control in File Station 6, CWE-863, v3.1 8.1 HIGH) letting an authenticated user bypass intended restrictions and reach sensitive files; and CVE-2026-24720 (uncontrolled resource consumption in File Station 6, CWE-770, v3.1 6.5) where an authenticated user exhausts CPU/memory to deny service. CVE-2025-59382 is a URL-injection flaw (CWE-472, external control of an assumed-immutable web parameter, v4.0 1.2 LOW) in a password-reset flow: a remote attacker can modify the password-reset URL to direct a victim to an attacker-controlled reset page, enabling credential theft via social engineering; NVD notes QTS/QuTS hero/QuTScloud themselves are not affected for this specific item, indicating it applies to an associated component bundled into the advisory.

No threat actor, in-the-wild exploitation, or public proof-of-concept code was reported in either the QNAP advisory or the NVD records; most flaws require a valid (often administrator) account, which constrains pre-authentication risk except for the resource-exhaustion and NULL-dereference DoS items. The pragmatic exposure is that QNAP devices are a recurring ransomware target (DeadBolt, Qlocker, eCh0raix historically), so chained credential compromise plus these command-injection and access-control bugs materially raises takeover risk. Defenders should apply the fixed builds immediately (QTS 5.2.9.3410 build 20260214 / branch 5.2.10, QuTS hero h5.2.9, QuTS cloud c5.2.9, QVP 2.8.0, File Station 5 5.5.6.5243+, File Station 6 fixed build), remove internet exposure of the admin UI, and monitor utilRequest.cgi and File Station for crashes, oversized filenames, and malformed requests.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1212 Exploitation for Credential Access
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1499 Endpoint Denial of Service
- T1489 Service Stop
- T1486 Data Encrypted for Impact

## Sources

- [QNAP Security Advisory QSA-26-10: Vulnerabilities in QTS, QuTS hero, QuTS cloud, and QVP](https://www.qnap.com/en/security-advisory/qsa-26-10)
- [QNAP Patches Multiple Injection Vulnerabilities](https://cybersecuritynews.com/qnap-patches-multiple-injection-vulnerabilities/)
- [NVD - CVE-2025-66273 (OS Command Injection, CWE-78)](https://nvd.nist.gov/vuln/detail/CVE-2025-66273)
- [NVD - CVE-2025-66279 (OS Command Injection, CWE-78)](https://nvd.nist.gov/vuln/detail/CVE-2025-66279)
- [NVD - CVE-2026-22893 (OS Command Injection, CWE-78)](https://nvd.nist.gov/vuln/detail/CVE-2026-22893)
- [NVD - CVE-2026-26240 (Stack-based Buffer Overflow, CWE-121, CRITICAL 9.1)](https://nvd.nist.gov/vuln/detail/CVE-2026-26240)
- [NVD - CVE-2026-26241 (Stack-based Buffer Overflow, CWE-121, CRITICAL 9.1)](https://nvd.nist.gov/vuln/detail/CVE-2026-26241)
- [NVD - CVE-2026-26239 (File Station 5 Buffer Overflow, CWE-121)](https://nvd.nist.gov/vuln/detail/CVE-2026-26239)
- [NVD - CVE-2025-62858 (Buffer/Stack Overflow, CWE-121)](https://nvd.nist.gov/vuln/detail/CVE-2025-62858)
- [NVD - CVE-2025-66280 (Integer Overflow, CWE-190/CWE-121)](https://nvd.nist.gov/vuln/detail/CVE-2025-66280)
- [NVD - CVE-2025-66281 (NULL Pointer Dereference, CWE-476)](https://nvd.nist.gov/vuln/detail/CVE-2025-66281)
- [NVD - CVE-2026-24724 (Incorrect Authorization, CWE-863)](https://nvd.nist.gov/vuln/detail/CVE-2026-24724)
- [NVD - CVE-2026-24720 (Uncontrolled Resource Consumption, CWE-770)](https://nvd.nist.gov/vuln/detail/CVE-2026-24720)
- [NVD - CVE-2026-22899 (NULL Pointer Dereference, CWE-476)](https://nvd.nist.gov/vuln/detail/CVE-2026-22899)
- [NVD - CVE-2025-59382 (URL Injection / External Control of Web Parameter, CWE-472)](https://nvd.nist.gov/vuln/detail/CVE-2025-59382)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0901