CVE-2026-22893: QTS, QuTS hero

Synopsis

A command injection vulnerability affects QNAP QTS and QuTS hero operating system versions. The flaw is reachable over the network but requires an attacker to first hold an administrator account; once that condition is met, the attacker can inject and execute arbitrary operating system commands on the affected device. Successful exploitation gives the attacker full control over the device, including the ability to read, modify, or destroy data and disrupt services. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is exposed over the network, so an attacker must be able to reach it across the internet or an internal network segment.

• AuthenticationRequired

  The attacker must hold an administrator account on the device; a low-privilege account is not sufficient to reach the vulnerable code path.

• Victim interactionNot required

  No action from a legitimate user is needed; the attacker can trigger the vulnerability entirely on their own once authenticated.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required beyond obtaining admin credentials.

Blast Radius

• The attacker executes arbitrary operating system commands on the QNAP device with the privileges of the injected process.
• All data stored on the NAS is readable, including files, credentials, and configuration secrets.
• Stored data and configuration can be modified or deleted, disrupting any services or backups hosted on the device.
• The device itself can be rendered unavailable, taking down all hosted services and any attached storage volumes.