CVE-2026-22893

Assessment

Why it matters

EPSS is 1.1%; technical severity is CVSS 8.6.

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later

Who should care

• Teams operating QTS, Quts Hero
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether QTS, Quts Hero is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Vendor advisory from www.qnap.com
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE

CWE-78

Affected versions

QNAP QTS (Start Including 5.2.0.2737, End Excluding 5.2.9.3410); QNAP Quts Hero (Start Including h5.2.0.2737, End Excluding h5.2.9.3410 | Start Including h5.3.0.3115, End Excluding h5.3.4.3500 | Start Including h6.0.0.3324, End Excluding h6.0.0.3459)

Fixed versions

QNAP QTS (Fixed from 5.2.9.3410); QNAP Quts Hero (Fixed from h5.2.9.3410, h5.3.4.3500, h6.0.0.3459)

Published

10 June 2026

Attack vector

Network

Privileges required

High

User interaction

None

Signal timeline

1. 10 Jun 2026CVE published
2. 21 Aug 2026Latest EPSS score: 1.1%
3. 19 Aug 2026 · 13:54 UTCSignal calculated at 14

External references

• Qnap Technical reference Qsa 26 10 ↗