CVE-2026-22893

HighCVSS 7.2/10Last modified Jul 23, 2026

Description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-228946.5A path traversal vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit CVE-2026-228954.8A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, t CVE-2026-228966.2A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator CVE-2026-228979.8A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execut CVE-2026-228989.8A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the CVE-2026-228996.5A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can the CVE-2026-22903.8The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This CVE-2026-229009.8A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerabili CVE-2026-229019.8A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit CVE-2026-229026.7A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then CVE-2026-229039.8An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buff CVE-2026-229049.8Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized