CVE-2026-24719 — QTS, QuTS hero

Back Back to CVE browser

MEDIUM

QTS, QuTS hero

Published Jun 10, 2026

6.1

MEDIUM

CVSS 4.0

EPSS 0.98%

Description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later

Affected products

Vendor QNAP Systems Inc. Product QTS Default
unaffected
- Version
  5.2.0
  Status
  affected
  Constraints
  <5.2.9.3492 build 20260507
Vendor QNAP Systems Inc. Product QuTS hero Default
unaffected
- Version
  h5.2.0
  Status
  affected
  Constraints
  <h5.2.9.3499 build 20260514

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

QNAP Systems Inc.

QTS

unaffected

Version	Status	Constraints
5.2.0	affected	<5.2.9.3492 build 20260507

QNAP Systems Inc.

QuTS hero

unaffected

Version	Status	Constraints
h5.2.0	affected	<h5.2.9.3499 build 20260514

Remediation

Vendor solution

We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later