Critical QNAP Security Flaws Could Allow Arbitrary Command Execution

QNAP has released security patches addressing 14 vulnerabilities across its QTS, QuTS hero, QuTS cloud, and QVP (QVR Pro Appliances) platforms.

Disclosed on April 6, 2026, and rated Important in severity, these flaws expose NAS devices to command injection, stack overflow, access control bypass, and denial-of-service attacks, posing significant risks to enterprise and SMB environments relying on QNAP storage systems.

The most critical issues in this advisory involve arbitrary command execution on affected devices. CVE-2025-66273 allows an authenticated administrator to inject arbitrary system commands via the username parameter, enabling direct code execution on the NAS.

Critical QNAP Security Flaws

Similarly, CVE-2025-66279 targets user deletion APIs, where an authenticated administrator can exploit the flaw to run arbitrary commands. CVE-2026-22893 further escalates this, allowing command execution with elevated privileges.

Separately, CVE-2025-59382 introduces a URL injection flaw that allows remote attackers to manipulate password reset links, redirecting victims to attacker-controlled pages and facilitating credential theft without requiring any direct system access.

Multiple stack-based overflow vulnerabilities add considerable depth to the threat landscape. CVE-2025-62858 allows a remote attacker with administrator privileges to trigger memory corruption and unpredictable system behavior.

CVE-2026-26240 demonstrates how an overly long upload filename can crash the utilRequest.cgi service through a stack-based buffer overflow.

CVE-2026-26241 is particularly notable because both authenticated and unauthenticated remote attackers can supply an excessively long filename during chunked file uploads, causing the affected CGI process to crash. Given its unauthenticated attack vector, it is one of the more dangerous entries.

CVE-2026-26239 enables authenticated users to perform unauthorized actions via a similar overflow condition, while CVE-2025-66280 can cause unexpected system behavior or a denial-of-service condition through stack manipulation.

Beyond code execution and overflow risks, QNAP addressed several vulnerabilities that can disrupt device availability and integrity.

CVE-2025-66281 is a pre-authentication NULL pointer dereference triggered by a malformed HTTP request with a missing or empty content-length header, meaning an unauthenticated attacker can crash the device entirely.

CVE-2026-22899 allows a low-privileged authenticated user to trigger a NULL pointer dereference in utilRequest.cgi, causing a segmentation fault and denial-of-service.

CVE-2026-24720 enables an authenticated remote attacker to exhaust system resources, driving up CPU and memory usage and degrading device responsiveness.

CVE-2025-68405 allows an authenticated administrator to force a denial-of-service condition via a stack overflow, and CVE-2026-24724 rounds out the advisory with a broken access-control flaw that lets authenticated users bypass restrictions and access sensitive files.

Affected Products and Fixed Versions

According to QNAP advisory, administrators are strongly urged to update affected devices immediately. For QTS, QuTS hero, and QuTS cloud, administrators should log in, navigate to Control Panel > System > Firmware Update, and select Check for Update under Live Update.

QVP users should go to Control Panel > System Settings > Firmware Update, upload the latest firmware file downloaded from QNAP’s official Download Center, and click Update System.

Given that several vulnerabilities require only low-privilege authenticated access and CVE-2025-66281 is exploitable without any credentials, organizations should treat this patch cycle as urgent, especially for any internet-exposed NAS devices.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.