QNAP QTS CVE-2025-66280

The primary fix is to upgrade to one of QNAP's patched releases: QTS 5.2.9.3410 build 20260214 or later, QuTS hero h5.2.9.3410 build 20260214 or later, QuTS hero h5.3.4.3500 build 20260520 or later, or QuTS hero h6.0.0.3397 build 20260206 or later. Updates are available through the QNAP QTS/QuTS hero control panel under System > Firmware Update or via the QNAP advisory at https://www.qnap.com/en/security-advisory/qsa-26-10. As a compensating control, organizations should enforce the principle of least privilege on QNAP administrator accounts and disable remote administrator access (HTTPS/SSH) from untrusted networks or the public internet, since exploitation requires an administrator credential - eliminating exposure of admin interfaces to external networks removes the network vector entirely. Enabling two-factor authentication on administrator accounts raises the bar for credential compromise, which is the prerequisite step. Side effect of restricting remote admin access: legitimate remote management workflows will require VPN or jump-host access instead.