Is CVE-2026-24716 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24716 being exploited in the wild.

How severe is CVE-2026-24716?

Informational severity, with a CVSS score of 5.1, published 10 June 2026.

Which products and versions are affected?

QNAP QTS 5.2.9.3492 build 20260507 and later.

Is there a fix for CVE-2026-24716?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-24716 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-24716?

Check whether you run QNAP QTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24716: QNAP QTS and QuTS hero NULL pointer dereference DoS

CVE-2026-24716 · Severity: info · CVSS 5.1 · Published 2026-06-10

QNAP has released security updates for several of its network-attached storage (NAS) operating systems to address a stability issue. An attacker who has already obtained administrator-level access to the device could trigger a system crash, leading to a denial-of-service. This would disrupt business operations and data availability until the system is recovered.

Technologies: QNAP QTS. Vendors: QNAP.

Quick answers

Is CVE-2026-24716 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24716 being exploited in the wild.
How severe is CVE-2026-24716?: Informational severity, with a CVSS score of 5.1, published 10 June 2026.
Which products and versions are affected?: QNAP QTS 5.2.9.3492 build 20260507 and later.
Is there a fix for CVE-2026-24716?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-24716 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-24716?: Check whether you run QNAP QTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference vulnerability (CWE-476) exists in multiple QNAP operating systems, including QTS and QuTS hero. The flaw is reachable over the network but requires high privileges (administrator account) to exploit. By triggering the dereference, an attacker can cause the affected service or system to crash, resulting in a denial-of-service (DoS) condition. QNAP has released patched firmware versions to address this issue.

Affected products

QNAP QTS 5.2.9.3492 build 20260507 and later
QNAP QuTS hero h5.2.9.3499 build 20260514 and later
QNAP QuTS hero h5.3.4.3500 build 20260520 and later
QNAP QuTS hero h6.0.0.3459 build 20260409 and later

Timeline

2026-06-10: disclosed
2026-06-10: advisory

References

https://www.qnap.com/en/security-advisory/qsa-26-18

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.