CVE-2026-41539: QTS, QuTS hero

Synopsis

A cross-site scripting (XSS) vulnerability affects QNAP QTS and QuTS hero operating system versions. XSS means an attacker can inject malicious scripts into pages served by the device, which then execute in the browser of any user who views the affected page. Exploitation is network-based, requires no authentication, and allows a successful attacker to bypass security mechanisms and read application data including session tokens. Patched-image rebuilds at the fixed versions are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the QNAP device over the network; the vulnerability is exposed remotely via the device's web interface.

• AuthenticationNot required

  No account or credentials are needed to deliver the malicious payload to the vulnerable application.

• Victim interactionRequired

  A logged-in user must visit or load the attacker-controlled or injected page for the script to execute in their browser, making this a social-engineering or phishing-assisted attack.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• A successful attacker reads stored session tokens and application data accessible in the victim's browser context.
• Injected scripts can bypass client-side security mechanisms such as same-origin checks or UI access controls enforced in the browser.
• Depending on application permissions, the attacker can perform actions on the QNAP device on behalf of the authenticated victim, including reading or modifying stored files and settings.