Back www.qnap.com

QNAP has addressed these vulnerabilities

www.qnap.com • June 22, 2026

Multiple vulnerabilities have been reported to affect QTS, QuTS hero, QuTS cloud and QVP (QVR Pro appliances):

We have already fixed the vulnerabilities in the following version:

To secure your device, we recommend regularly updating your system to the latest version to benefit from vulnerability fixes. You can check the product support status to see the latest updates available to your NAS model.

Updating QTS, QuTS hero, or QuTScloud

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.

Updating QVP (QVR Pro Appliances)

Revision History: V1.0 (June 17, 2026) - Published

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

QNAP Addresses 14 Vulnerabilities in NAS and Surveillance Systems QNAP has released security advisory QSA-26-10 to address 14 vulnerabilities in its NAS and surveillance platforms, including QTS, QuTS hero, QuTS cloud, and QVP (QVR Pro appliances). These vulnerabilities, disclosed on April 6, 2026, are categorized as having 'Important' severity. Notable issues include CVE-2025-59382, a URL injection flaw that could lead to credential harvesting, and several command injection vulnerabilities (CVE-2025-66273, CVE-2025-66279, CVE-2026-22893) that allow arbitrary command execution. Other critical vulnerabilities involve memory safety issues, such as stack and buffer overflows (CVE-2025-62858, CVE-2026-26239, CVE-2026-26241), which can cause service crashes. QNAP has released firmware updates to mitigate these vulnerabilities, urging users to update immediately to prevent exploitation. The vulnerabilities affect versions QTS 5.2.7, QuTS hero h5.2.8, QuTS cloud c5.2.8, and QVP 2.7.1. 12 sources 58

Extracted Entities

Platforms (5)

QTS QuTS Cloud QuTS hero QVP QVR Pro Appliances