CVE-2026-34009

HighCVSS 8.4/10Last modified Oct 15, 2026

Description

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

Metrics

CVSS 4.0 8.4/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-653

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
QNAP Systems Inc.	Notes Station 3	>= 3.9.x, < 3.9.11

References

https://www.qnap.com/en/app-release-notes?keyword=Notes%20Station%203&app=NotesStation3&product-line=nas

Timeline

Published: Oct 15, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-34016.6A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipu CVE-2026-340148.4An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gai CVE-2026-340156.5A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit t CVE-2026-340168.5Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers CVE-2026-340175.8Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unpriv CVE-2026-340189.8An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the p CVE-2026-340195.3When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traff CVE-2026-34024.8A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code CVE-2026-340207.5Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method w CVE-2026-340218.6The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the mi CVE-2026-340227.1The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with CVE-2026-340237.1The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket co