CVE-2026-24719
Received Received - Intake
Command Injection in QNAP QTS and QuTS hero

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: QNAP Systems, Inc.

Description
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-10
Generated
2026-06-10
AI Q&A
2026-06-10
EPSS Evaluated
N/A
NVD
CVE-2026-24719
EUVD
EUVD-2026-35977
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
qnap qts From 5.2.9.3492 (inc)
qnap quts_hero From h5.2.9.3499 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a command injection issue affecting several versions of QNAP operating systems. It allows a remote attacker who has obtained an administrator account to execute arbitrary commands on the affected system.

Impact Analysis

If exploited, this vulnerability can allow an attacker with administrator access to run any commands they choose on the system, potentially leading to full system compromise, data theft, data loss, or disruption of services.

Mitigation Strategies

To mitigate this vulnerability, you should update your QNAP operating system to the fixed versions.

  • For QTS, update to version 5.2.9.3492 build 20260507 or later.
  • For QuTS hero, update to version h5.2.9.3499 build 20260514 or later.

Ensure that only trusted administrators have access to the system to prevent exploitation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24719. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart