CVE-2026-24719Disclosure(qnap / qts)

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later

qnap CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://www.qnap.com/en/security-advisory/qsa-26-10

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

qts
quts_hero

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-06-10); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

qnap

Products

qtsquts_hero

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-10	3	Disclosure3
2026-06-23	1	General1

Full discourse4 posts

CVE@CVEnew136d
Disclosure
CVE-2026-24719 A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can th… https://www.cve.org/CVERecord?id=CVE-2026-24719
Post summary
CVE-2026-24719 is a command injection vulnerability in QNAP OS that requires an admin account; no PoC, exploit, patch, or active exploitation is mentioned.
00010365
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-24719 Command Injection in QNAP Operating System Versions Below 5.2.9.3492 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24719
Post summary
This entry announces a command injection vulnerability in QNAP Operating System versions below 5.2.9.3492, providing basic technical details but no evidence of active exploitation, PoC, or patch.
0001061
4.0K followersView on X
CERT-PY@CERTpy122d
General
⚠️ Vulnerabilidades en productos QNAP ❗ CVE-2026-41539 ❗ CVE-2026-24719 ❗ CVE-2025-66276 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-qnap-4/ https://t.co/YcxLQIclQv
Post summary
The tweet lists three CVE identifiers for QNAP products and provides two URLs for additional information, but contains no details on exploits, patches, or technical aspects.
00000261
6.7K followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2026-24719 A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can th… https://www.cve.org/CVERecord?id=CVE-2026-24719 ----- Traducción: CVE-2026-24719 Se … http://infoflow.cloud`
Post summary
The post announces a new command injection vulnerability (CVE-2026-24719) in QNAP operating systems, providing a brief technical description but no evidence of exploitation, PoC, or remediation.
0000039
79 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	qnap	qts	-	-	-
OS	qnap	quts_hero	-	-	-

Explore more

Back to dashboard qnap CVEs qts vulnerabilities

What researchers are saying

CVE-2026-24719

CVE@CVEnewDisclosure

CVE-2026-24719 is a command injection vulnerability in QNAP OS that requires an admin account; no PoC, exploit, patch, or active exploitation is mentioned.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

This entry announces a command injection vulnerability in QNAP Operating System versions below 5.2.9.3492, providing basic technical details but no evidence of active exploitation, PoC, or patch.

CERT-PY@CERTpyGeneral

The tweet lists three CVE identifiers for QNAP products and provides two URLs for additional information, but contains no details on exploits, patches, or technical aspects.

Infoflowcloud@infoflowcloudDisclosure

The post announces a new command injection vulnerability (CVE-2026-24719) in QNAP operating systems, providing a brief technical description but no evidence of exploitation, PoC, or remediation.