CVE-2026-24719

HighCVSS 7.2/10Last modified Jul 23, 2026

Description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-24728.1Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versi CVE-2026-247206.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gains CVE-2026-247216.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can the CVE-2026-247226.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can the CVE-2026-247236.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can the CVE-2026-247248.1An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can the CVE-2026-247279.3An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Managemen CVE-2026-247289.3A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025 CVE-2026-2472910.0An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10 CVE-2026-24737.7Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google CVE-2026-247319.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate CVE-2026-247326.6Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH