Back Hkcert

QNAP NAS Elevation of Privilege Vulnerability

Hkcert • May 4, 2026

A vulnerability was identified in QNAP NAS. A local attacker can exploit this vulnerability to trigger elevation of privilege on the targeted system.

CVE-2026-31431 is being exploited in the wild. A local privilege escalation vulnerability, commonly known as " Copy Fail ", has been reported to affect the Linux kernel. If exploited, this vulnerability could allow an authenticated, non-administrator user with code execution capabilities to obtain elevated system privileges.

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

QNAP NAS Local Privilege Escalation Vulnerability Exploited in the Wild A local privilege escalation vulnerability, identified as CVE-2026-31431, has been reported to affect QNAP NAS devices. This vulnerability, also referred to as 'Copy Fail', allows authenticated non-administrator users with code execution capabilities to gain elevated system privileges. The vulnerability is currently being exploited in the wild, raising significant security concerns. QNAP is actively investigating the issue and is developing security updates, but no official mitigation is available at this time. Users are advised to monitor for updates and apply patches as soon as they are released. The vulnerability affects specific versions of the Linux kernel used in QNAP systems. Security measures are recommended to reduce exposure on potentially affected devices. The first public proof of concept (PoC) for this vulnerability was released on May 1, 2026. 2 sources 70

Extracted Entities

QNAP NAS Elevation of Privilege Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)