Is CVE-2026-24724 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24724 being exploited in the wild.

How severe is CVE-2026-24724?

Informational severity, with a CVSS score of 8.6, published 10 June 2026.

Which products and versions are affected?

QNAP Systems File Station 6 Versions prior to 5.5.6.5243.

Is there a fix for CVE-2026-24724?

A patch was published on 2026-06-10: Fix released in version 5.5.6.5243 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24724 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-24724?

Check whether you run QNAP Systems File Station 6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24724: QNAP File Station incorrect authorization bypass

CVE-2026-24724 · Severity: info · CVSS 8.6 · Published 2026-06-10

QNAP File Station is a web-based tool used to manage files on QNAP storage devices. A security flaw allows a user with a standard account to bypass security restrictions and access files or perform actions they should not be authorized to do. This could lead to the unauthorized viewing or modification of sensitive data stored on the device.

Vendors: QNAP Systems.

Quick answers

Is CVE-2026-24724 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24724 being exploited in the wild.
How severe is CVE-2026-24724?: Informational severity, with a CVSS score of 8.6, published 10 June 2026.
Which products and versions are affected?: QNAP Systems File Station 6 Versions prior to 5.5.6.5243.
Is there a fix for CVE-2026-24724?: A patch was published on 2026-06-10: Fix released in version 5.5.6.5243 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24724 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-24724?: Check whether you run QNAP Systems File Station 6 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in QNAP File Station 6. The flaw allows a remote attacker who has already obtained a valid user account to bypass intended access control mechanisms. By exploiting this vulnerability, the attacker can gain unauthorized access to files or system functions beyond their assigned privileges. The vulnerability is addressed in File Station 5 version 5.5.6.5243 and later. The attack requires low privileges and no user interaction.

Affected products

QNAP File Station 6 Versions prior to 5.5.6.5243

Timeline

2026-06-10: advisory: QNAP published security advisory QSA-26-29
2026-06-10: patched: Fix released in version 5.5.6.5243

References

https://www.qnap.com/en/security-advisory/qsa-26-29

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.