Is CVE-2025-66279 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66279 being exploited in the wild.

How severe is CVE-2025-66279?

Informational severity, with a CVSS score of 8.6, published 10 June 2026.

Which products and versions are affected?

QNAP Systems, Inc. QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3397 build 20260206.

Is there a fix for CVE-2025-66279?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-66279 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-66279?

Check whether you run QNAP Systems or Inc. QuTS hero at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66279: QNAP QTS and QuTS hero command injection

CVE-2025-66279 · Severity: info · CVSS 8.6 · Published 2026-06-10

A security vulnerability has been identified in QNAP operating systems used to manage Network Attached Storage (NAS) devices. If an attacker manages to obtain administrator credentials, they can exploit this flaw to run unauthorized commands on the system. This could lead to a complete takeover of the device, resulting in data loss, service disruption, or unauthorized access to stored files.

Technologies: QNAP Systems, Inc. QuTS hero. Vendors: QNAP Systems, Inc..

Quick answers

Is CVE-2025-66279 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66279 being exploited in the wild.
How severe is CVE-2025-66279?: Informational severity, with a CVSS score of 8.6, published 10 June 2026.
Which products and versions are affected?: QNAP Systems, Inc. QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3397 build 20260206.
Is there a fix for CVE-2025-66279?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-66279 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-66279?: Check whether you run QNAP Systems or Inc. QuTS hero at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability (CWE-78) exists in several QNAP operating system versions, including QTS and QuTS hero. The flaw is rooted in the improper neutralization of special elements used in OS commands. An attacker with high privileges (administrator account) can exploit this vulnerability over the network without user interaction to execute arbitrary commands with system-level permissions. QNAP has released security updates to address this issue in QTS 5.2.9.3410, QuTS hero h5.2.9.3410, h5.3.4.3500, and h6.0.0.3397.

Affected products

QNAP Systems, Inc. QTS 5.2.x prior to 5.2.9.3410 build 20260214
QNAP Systems, Inc. QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3397 build 20260206

Timeline

2026-06-10: disclosed
2026-06-10: advisory

References

https://www.qnap.com/en/security-advisory/qsa-26-10

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.