Is there a patch available for CVE-2026-22899?

Yes, a patch is available for CVE-2026-22899. Update the affected software to the latest version immediately.

QNAP File Station CVE-2026-22899

Q: What is the CVSS score of CVE-2026-22899?

CVE-2026-22899 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-35973 LOW

NULL Pointer Dereference (CWE-476)

2026-06-10 qnap

GHSA-vj77-7vg3-hgxm

Denial Of Service Null Pointer Dereference File Station 5 Qnap Systems Inc

1.3

CVSS 4.0 · Vendor: qnap

Severity by source

Vendor (qnap) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (qnap) · only source for this CVE.

CVSS VectorVendor: qnap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 23, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jul 23, 2026 - 09:22 NVD

5.3 (MEDIUM) 1.3 (LOW)

Analysis Generated

Jun 10, 2026 - 06:25 vuln.today

Patch available

Jun 10, 2026 - 05:01 EUVD

CVSS changed

Jun 10, 2026 - 04:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 10, 2026 - 03:07 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

AnalysisAI

NULL pointer dereference in QNAP File Station 5 enables authenticated remote attackers to crash the service and cause a denial-of-service condition. Exploitation requires prior acquisition of a valid user account on the target QNAP NAS device, after which the attacker can trigger the dereference remotely over the network. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability is a NULL pointer dereference (CWE-476), a memory-safety defect where the application attempts to read or write through a pointer that has not been initialized or has been set to NULL, resulting in a process crash. The affected component is QNAP File Station 5, a web-based file management application bundled with QNAP NAS operating systems, identified by CPE cpe:2.3:a:qnap_systems_inc.:file_station_5:*:*:*:*:*:*:*:*. CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N indicates the flaw is reachable over the network with low attack complexity and no additional triggering conditions, but requires a low-privileged authenticated session. The impact is confined to availability (VA:L), with no confidentiality or integrity consequences, consistent with a pure DoS crash scenario.

RemediationAI

Upgrade QNAP File Station 5 to version 5.5.6.5208 or later, as confirmed by the vendor-released patch documented in QNAP security advisory QSA-26-19 (https://www.qnap.com/en/security-advisory/qsa-26-19). This is the primary and recommended fix. As a compensating control where immediate patching is not possible, administrators should restrict File Station access to the minimum necessary user accounts, revoke unused credentials, and limit network access to File Station to trusted IP ranges via firewall rules or QNAP's built-in network access control - this reduces the pool of accounts that could be weaponized to trigger the DoS. Restricting access may impact legitimate remote file management workflows and should be balanced against operational needs. Monitor for unexpected File Station service crashes as an indicator of exploitation attempts.