CVE-2026-39997
Received Received - Intake

Remote Code Execution in HybridDesk Station

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: QNAP Systems, Inc.

Description
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-39997
EUVD
EUVD-2026-101988

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
QNAP Systems Inc. HybridDesk Station 4.2.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a missing authentication for critical function vulnerability in HybridDesk Station. It allows remote attackers to gain unauthorized access to the system without needing valid credentials.

Impact Analysis

An attacker could exploit this to remotely access your system, potentially leading to data theft, system manipulation, or further network compromise. The high CVSS score (8.9) indicates significant risk.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements under GDPR and HIPAA. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update HybridDesk Station to version 4.2.22 or later to address the missing authentication vulnerability. Ensure no unauthorized access has occurred by reviewing system logs and user activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39997. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart