# QNAP Systems vulnerabilities & exploitation > As of 2026-10-05, Threadlinqs tracks 12 QNAP Systems CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 2 tracked threat campaigns. **Data as of:** 2026-10-05 ## Exploitation timeline Threadlinqs has recorded 12 QNAP Systems CVEs published between 2026-01-15 and 2026-06-15. The busiest month was 2026-06 (11 new CVEs). None of them is listed in CISA KEV yet. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 12 of 12 tracked QNAP Systems CVEs. - [CVE-2025-66273](https://intel.threadlinqs.com/cve/CVE-2025-66273) — HIGH 7.2 · EPSS 1% · 2026-06-10 - [CVE-2025-66279](https://intel.threadlinqs.com/cve/CVE-2025-66279) — HIGH 7.2 · EPSS 1% · 2026-06-10 - [CVE-2026-22893](https://intel.threadlinqs.com/cve/CVE-2026-22893) — HIGH 7.2 · EPSS 1% · 2026-06-10 - [CVE-2025-11837](https://intel.threadlinqs.com/cve/CVE-2025-11837) — CRITICAL 9.8 · EPSS 0.8% · 2026-01-02 - [CVE-2025-66281](https://intel.threadlinqs.com/cve/CVE-2025-66281) — MEDIUM 6.9 · EPSS 0.3% · 2026-06-10 - [CVE-2025-66280](https://intel.threadlinqs.com/cve/CVE-2025-66280) — HIGH 7.2 · EPSS 0.3% · 2026-06-10 - [CVE-2026-26240](https://intel.threadlinqs.com/cve/CVE-2026-26240) — CRITICAL 9.1 · EPSS 0.3% · 2026-06-10 - [CVE-2026-26241](https://intel.threadlinqs.com/cve/CVE-2026-26241) — CRITICAL 9.1 · EPSS 0.3% · 2026-06-10 - [CVE-2025-62858](https://intel.threadlinqs.com/cve/CVE-2025-62858) — MEDIUM 6.5 · EPSS 0.3% · 2026-06-09 - [CVE-2026-26239](https://intel.threadlinqs.com/cve/CVE-2026-26239) — HIGH 8.1 · EPSS 0.3% · 2026-06-10 - [CVE-2026-24724](https://intel.threadlinqs.com/cve/CVE-2026-24724) — HIGH 8.1 · EPSS 0.3% · 2026-06-10 - [CVE-2025-59382](https://intel.threadlinqs.com/cve/CVE-2025-59382) — LOW 1.2 · EPSS 0.3% · 2026-06-10 ## Products affected Threadlinqs normalises CPE and CNA product records across all 12 CVEs; 5 distinct QNAP Systems products are affected. The most frequently affected: - QTS — 7 CVEs - QuTS hero — 7 CVEs - File Station 5 — 4 CVEs - Malware Remover — 1 CVE - QuTScloud — 1 CVE ## Threat activity 2 tracked threat campaigns reference QNAP Systems products or exploit QNAP Systems CVEs: - [QNAP QSA-26-10: Multiple Injection and Memory-Safety Vulnerabilities in QTS, QuTS hero, QuTS cloud, QVP, and File Station (CVE-2025-66273, CVE-2026-26240, and 12 others)](https://intel.threadlinqs.com/threat/TL-2026-0901) — HIGH — 2026-06-22 - [AryStinger (Ary-Attack) Botnet Compromises 4,000+ Legacy D-Link/RTL819X Routers and NAS for Global Attack Proxy Infrastructure (CVE-2013-3307, CVE-2016-5681, CVE-2025-11837)](https://intel.threadlinqs.com/threat/TL-2026-0894) — HIGH — 2026-06-21 ## How to prioritise QNAP Systems patching This order follows the data Threadlinqs holds for QNAP Systems, not a generic severity checklist: - No QNAP Systems CVE is in CISA KEV yet, so rank by exploit probability instead. - Outside KEV, the highest EPSS scores are [CVE-2025-66273](https://intel.threadlinqs.com/cve/CVE-2025-66273) (1%), [CVE-2025-66279](https://intel.threadlinqs.com/cve/CVE-2025-66279) (1%), [CVE-2026-22893](https://intel.threadlinqs.com/cve/CVE-2026-22893) (1%). - 3 CVEs score Critical and 6 High on CVSS v3 (maximum 9.8, average 7.3); sequence these after KEV and high-EPSS items. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/qnap-systems All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp