PT-2026-48364 · Qnap · Qts+1
CVE-2026-22893
·
Published
2026-06-10
·
Updated
2026-06-10
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
QTS versions prior to 5.2.9.3410 build 20260214
QuTS hero versions prior to h5.2.9.3410 build 20260214
QuTS hero versions prior to h5.3.4.3500 build 20260520
QuTS hero versions prior to h6.0.0.3459 build 20260409
Description
A command injection issue allows a remote attacker with administrator account access to execute arbitrary commands on the system.
Recommendations
Update QTS to version 5.2.9.3410 build 20260214 or later.
Update QuTS hero to version h5.2.9.3410 build 20260214 or later.
Update QuTS hero to version h5.3.4.3500 build 20260520 or later.
Update QuTS hero to version h6.0.0.3459 build 20260409 or later.
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Qts
Quts Hero