CVE-2026-22901Disclosure(qnap / qunetswitch)

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

0.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • qunetswitch

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-03-22)
  • 3 total mentions across 2 days

Affected systems

Vendors
Products
qunetswitch

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-20: 1Mentions · 2026-03-22: 2Technical Details · 2026-03-20: 1Technical Details · 2026-03-22: 203-2003-22
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-201
Disclosure1
2026-03-222
Disclosure2
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-22901 Command Injection Vulnerability in QuNetSwitch Enabling Remote Arbitrary Command Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-22901

    Post summary

    The snippet announces a new command injection vulnerability (CVE-2026-22901) in QuNetSwitch that could allow remote arbitrary command execution, but it does not provide PoCs, exploits, or patches.

    0001062
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-22901 A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execu… https://www.cve.org/CVERecord?id=CVE-2026-22901 ----- Traducción: CVE-2026-22901 Se … http://infoflow.cloud`

    Post summary

    The tweet announces a new command injection vulnerability (CVE-2026-22901) affecting QuNetSwitch, noting that a remote attacker could execute commands if they obtain a user account, but does not discuss PoCs, exploits, or defenses.

    0000012
    61 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-22901 A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execu… https://www.cve.org/CVERecord?id=CVE-2026-22901

    Post summary

    A new command injection vulnerability (CVE‑2026‑22901) affecting QuNetSwitch has been reported, allowing a remote attacker with user credentials to execute arbitrary commands.

    00000119
    56.8K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appqnapqunetswitch---

Explore more