CVE-2026-22893

Analyzed Analyzed - Analysis Complete

Command Injection in QNAP QTS and QuTS hero

Publication date: 2026-06-10

Last updated on: 2026-06-15

Assigner: QNAP Systems, Inc.

Description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-15

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-29

NVD

CVE-2026-22893

EUVD

EUVD-2026-35972

Affected Vendors & Products

Vendor	Product	Version / Range
qnap	quts_hero	From h5.3.0.3115 (inc) to h5.3.4.3500 (exc)
qnap	quts_hero	From h6.0.0.3324 (inc) to h6.0.0.3459 (exc)
qnap	qts	From 5.2.0.2737 (inc) to 5.2.9.3410 (exc)
qnap	quts_hero	From h5.2.0.2737 (inc) to h5.2.9.3410 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw affecting several versions of QNAP operating systems. It allows a remote attacker who has obtained an administrator account to execute arbitrary commands on the affected system.

Impact Analysis

If exploited, this vulnerability can allow an attacker with administrator access to run any commands they choose on the system. This could lead to unauthorized control over the device, data compromise, disruption of services, or further attacks within the network.

Mitigation Strategies

To mitigate this vulnerability, you should update your QNAP operating system to one of the fixed versions listed below:

QTS 5.2.9.3410 build 20260214 or later
QuTS hero h5.2.9.3410 build 20260214 or later
QuTS hero h5.3.4.3500 build 20260520 or later
QuTS hero h6.0.0.3459 build 20260409 or later

Additionally, restrict administrator account access to trusted users only, as exploitation requires administrator privileges.

Hi! I’m here to help you understand CVE-2026-22893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70