CVE-2026-26240Disclosure(qnap / file_station)

LOWCVSS 9.1 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

qnap CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

https://www.qnap.com/en/security-advisory/qsa-26-10

Weakness type (CWE)

CWE-121

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

file_station

Threat summary

Public PoC is present in monitored signal
4 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 1d ago at 3 mentions (2026-06-10); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

qnap

Products

file_station

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

PoC

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-10	3	Disclosure3
2026-07-22	1	PoC1

Full discourse4 posts

Matthias Deeg@matthiasdeeg94d
PoC
We have also created a proof-of-concept video demonstrating arbitrary file deletion, arbitrary file read, and remote code execution by exploiting the corresponding security vulnerabilities CVE-2026-26239, CVE-2026-26240, and CVE-2026-26241. https://www.youtube.com/watch?v=_6Pwdss-8cQ
Post summary
A proof-of-concept video demonstrates that CVE-2026-26239, CVE-2026-26240, and CVE-2026-26241 enable arbitrary file deletion, read, and remote code execution, with no mention of active exploitation or mitigations.
02085883
593 followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2026-26240 A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processe… https://www.cve.org/CVERecord?id=CVE-2026-26240 ----- Traducción: CVE-2026-26240 Se … http://infoflow.cloud`
Post summary
A new buffer‑overflow vulnerability (CVE‑2026‑26240) in File Station 5 has been disclosed, enabling remote attackers to alter memory or force a crash, although no PoC, exploit code, or patch details are provided.
0000029
79 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-26240 A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processe… https://www.cve.org/CVERecord?id=CVE-2026-26240
Post summary
A buffer overflow vulnerability (CVE‑2026‑26240) has been disclosed for File Station 5, potentially enabling remote memory modification or process crashing.
00000175
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-26240 Buffer Overflow Vulnerability in Synology File Station 5 Before 5.5.6.5243 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26240
Post summary
The announcement references a buffer overflow vulnerability affecting Synology File Station prior to version 5.5.6.5243, with no PoC, exploit, or patch details provided.
0000068
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	qnap	file_station	-	-	-

Explore more

Back to dashboard qnap CVEs file_station vulnerabilities

What researchers are saying

CVE-2026-26240

Matthias Deeg@matthiasdeegPoC

A proof-of-concept video demonstrates that CVE-2026-26239, CVE-2026-26240, and CVE-2026-26241 enable arbitrary file deletion, read, and remote code execution, with no mention of active exploitation or mitigations.

Infoflowcloud@infoflowcloudDisclosure

A new buffer‑overflow vulnerability (CVE‑2026‑26240) in File Station 5 has been disclosed, enabling remote attackers to alter memory or force a crash, although no PoC, exploit code, or patch details are provided.

CVE@CVEnewDisclosure

A buffer overflow vulnerability (CVE‑2026‑26240) has been disclosed for File Station 5, potentially enabling remote memory modification or process crashing.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The announcement references a buffer overflow vulnerability affecting Synology File Station prior to version 5.5.6.5243, with no PoC, exploit, or patch details provided.