Quick answers
- Is CVE-2025-66274 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-66274 being exploited in the wild.
- How severe is CVE-2025-66274?
- Medium severity, with a CVSS score of 4.9, published 11 February 2026.
- Which products and versions are affected?
- QNAP QTS 5.2.9.3410 build 20260214 and later.
- Is there a fix for CVE-2025-66274?
- A patch was published on 2025-12-25: Fix released for QuTS hero h5.3.x Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-66274 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2025-66274?
- Check whether you run QNAP QTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A NULL pointer dereference vulnerability (CWE-476) exists in several QNAP operating system versions, including QTS and QuTS hero. The flaw is reachable over the network but requires high privileges, specifically an administrator account. By exploiting this vulnerability, an authenticated attacker can cause a system crash or process termination, resulting in a denial-of-service (DoS) condition. QNAP has released security updates to address this issue across the affected product lines.
Affected products
- QNAP QTS 5.2.9.3410 build 20260214 and later
- QNAP QuTS hero h5.2.9.3410 build 20260214 and later; h5.3.2.3354 build 20251225 and later; h6.0.0.3397 build 20260206 and later
Timeline
- 2026-02-11: advisory: Initial NVD publication date
- 2026-02-12: advisory: QNAP security advisory QSA-26-08 published
- 2025-12-25: patched: Fix released for QuTS hero h5.3.x