QNAP Patches Multiple Injection Vulnerabilities Leads to Arbitrary Command Execution

Cybersecuritynews •Abinaya • June 22, 2026

QNAP has released security updates to address multiple vulnerabilities affecting its widely used NAS operating systems, including QTS, QuTS hero, QuTS cloud, and QVP (QVR Pro appliances). The advisory highlights a series of critical flaws that could allow attackers to execute arbitrary commands, trigger denial-of-service (DoS) conditions, and bypass access controls. The vulnerabilities, disclosed on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

QNAP Addresses 14 Vulnerabilities in NAS and Surveillance Systems QNAP has released security advisory QSA-26-10 to address 14 vulnerabilities in its NAS and surveillance platforms, including QTS, QuTS hero, QuTS cloud, and QVP (QVR Pro appliances). These vulnerabilities, disclosed on April 6, 2026, are categorized as having 'Important' severity. Notable issues include CVE-2025-59382, a URL injection flaw that could lead to credential harvesting, and several command injection vulnerabilities (CVE-2025-66273, CVE-2025-66279, CVE-2026-22893) that allow arbitrary command execution. Other critical vulnerabilities involve memory safety issues, such as stack and buffer overflows (CVE-2025-62858, CVE-2026-26239, CVE-2026-26241), which can cause service crashes. QNAP has released firmware updates to mitigate these vulnerabilities, urging users to update immediately to prevent exploitation. The vulnerabilities affect versions QTS 5.2.7, QuTS hero h5.2.8, QuTS cloud c5.2.8, and QVP 2.7.1. 12 sources 58

Extracted Entities

QNAP Patches Multiple Injection Vulnerabilities Leads to Arbitrary Command Execution

The full story

Extracted Entities

Companies (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (3)