What is the CVSS score of CVE-2024-14026?

CVE-2024-14026 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Quts Hero are affected by CVE-2024-14026?

CVE-2024-14026 affects QNAP NAS devices and allows authenticated attackers with local network access to execute arbitrary commands, potentially compromising stored data and system integrity.

How to fix or mitigate CVE-2024-14026?

Within 24 hours: Inventory all QNAP devices in use and document their network location and access controls. Within 7 days: Implement network segmentation to restrict local network access to QNAP devices to authorized personnel only, and enforce multi-factor authentication for all user accounts. Within 30 days: Monitor QNAP security advisories for patch availability and establish a testing environment to validate patches before production deployment.

Quts Hero CVE-2024-14026

HIGH

OS Command Injection (CWE-78)

2026-03-11 security@qnapsecurity.com.tw

Qnap Command Injection Quts Hero Qts

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 08:16 nvd

HIGH 7.8

DescriptionCVE.org

A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.3.3006 build 20250108 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.3.3006 build 20250108 and later

AnalysisAI

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects Qts. A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands.