Is CVE-2026-22893 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22893 being exploited in the wild.

How severe is CVE-2026-22893?

Informational severity, with a CVSS score of 8.6, published 10 June 2026.

Which products and versions are affected?

QNAP QTS 5.2.x versions prior to 5.2.9.3410 build 20260214.

Is there a fix for CVE-2026-22893?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-22893 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-22893?

Check whether you run QNAP QTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22893: QNAP QTS and QuTS hero command injection

CVE-2026-22893 · Severity: info · CVSS 8.6 · Published 2026-06-10

A security vulnerability has been identified in QNAP's QTS and QuTS hero operating systems, which power their Network Attached Storage (NAS) devices. If an attacker manages to obtain administrator credentials, they can use this flaw to take full control of the device and execute unauthorized commands. This could lead to the theft of sensitive data, permanent loss of files, or the device being used as a foothold for further attacks on the corporate network.

Technologies: QNAP QTS. Vendors: QNAP.

Quick answers

Is CVE-2026-22893 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22893 being exploited in the wild.
How severe is CVE-2026-22893?: Informational severity, with a CVSS score of 8.6, published 10 June 2026.
Which products and versions are affected?: QNAP QTS 5.2.x versions prior to 5.2.9.3410 build 20260214.
Is there a fix for CVE-2026-22893?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-22893 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-22893?: Check whether you run QNAP QTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in multiple versions of QNAP's QTS and QuTS hero operating systems. The flaw allows a remote attacker with high privileges (administrator account) to bypass security restrictions and execute arbitrary system commands via the network. The vulnerability stems from improper neutralization of special elements used in an OS command. Successful exploitation results in complete compromise of the Confidentiality, Integrity, and Availability of the host system. QNAP has released security updates to address this issue in QTS 5.2.9.3410, QuTS hero h5.2.9.3410, h5.3.4.3500, and h6.0.0.3459.

Affected products

QNAP QTS 5.2.x versions prior to 5.2.9.3410 build 20260214
QNAP QuTS hero h5.2.x prior to h5.2.9.3410 build 20260214; h5.3.x prior to h5.3.4.3500 build 20260520; h6.0.x prior to h6.0.0.3459 build 20260409

Timeline

2026-06-10: disclosed
2026-06-10: advisory

References

https://www.qnap.com/en/security-advisory/qsa-26-10

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.