Is CVE-2026-22899 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22899 being exploited in the wild.

How severe is CVE-2026-22899?

Informational severity, with a CVSS score of 5.3, published 10 June 2026.

Which products and versions are affected?

QNAP File Station Versions prior to 5.5.6.5208.

Is there a fix for CVE-2026-22899?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-22899 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-22899?

Check whether you run QNAP File Station at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22899: QNAP File Station NULL pointer dereference in File Station 6

CVE-2026-22899 · Severity: info · CVSS 5.3 · Published 2026-06-10

QNAP File Station, a web-based application for managing files on QNAP NAS devices, is affected by a security flaw that could allow a user to crash the service. An attacker who already has a valid user account on the system can trigger this issue to cause a denial-of-service, making the file management interface unavailable to other users. This impact is limited to service availability and does not involve the theft of data or unauthorized access to files.

Technologies: QNAP File Station. Vendors: QNAP.

Quick answers

Is CVE-2026-22899 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22899 being exploited in the wild.
How severe is CVE-2026-22899?: Informational severity, with a CVSS score of 5.3, published 10 June 2026.
Which products and versions are affected?: QNAP File Station Versions prior to 5.5.6.5208.
Is there a fix for CVE-2026-22899?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-22899 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-22899?: Check whether you run QNAP File Station at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference (CWE-476) exists in QNAP File Station 6. The vulnerability is reachable over the network but requires the attacker to possess valid user credentials (low privileges). By sending a specifically crafted request that triggers the NULL pointer dereference, an attacker can cause the application to crash, resulting in a denial-of-service. The vendor has released a fix in File Station version 5.5.6.5208 and later.

Affected products

QNAP File Station 6 Versions prior to 5.5.6.5208

Timeline

2026-06-10: disclosed
2026-06-10: advisory

References

https://www.qnap.com/en/security-advisory/qsa-26-19

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.