QNAP vulnerabilities
We track 252 vulnerabilities in QNAP products across 60+ products. 250 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on October 29, 2026.
Latest QNAP vulnerabilities
- 9.8 Critical severity
QNAP NAS Improper Authorization Exploited
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0
- 9.8 Critical severity
QNAP Network-Attached Storage (NAS) Command Injection Exploited
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: Q
- 9.8 Critical severity
QNAP Helpdesk Improper Access Control Exploited
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issu
- 6.1 Medium severity
QNAP NAS File Station Cross-Site Scripting Exploited
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on b
- 9.8 Critical severity
QNAP NAS File Station Command Injection Exploited
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on bui
- 5.4 Medium severity
QNAP NAS File Station Cross-Site Scripting Exploited
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS
- 9.8 Critical severity
QNAP Photo Station Path Traversal Exploited
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
- 9.8 Critical severity
QNAP Photo Station Path Traversal Exploited
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
- 9.8 Critical severity
QNAP QTS Improper Input Validation Exploited
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
- 9.8 Critical severity
QNAP Photo Station Improper Access Control Exploited
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
- 9.8 Critical severity
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Exploited
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as
- 9.8 Critical severity
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Exploited
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature