QNAP File Station 5 CVE-2026-26239

Attacker must possess valid credentials for any user account on the target QNAP NAS (CVSS PR:L), and the File Station 5 app must be installed and reachable on a version between 5.5.0 and 5.5.6.5208 - File Station is bundled by default on QTS/QuTS hero but can be uninstalled. The File Station web interface (typically the NAS management port) must be network-reachable from the attacker (AV:N), but no user interaction, no MFA bypass, and no administrator role are required. Limiting factors: NAS units not exposed to the internet and without attacker-controlled user accounts are not remotely exploitable; sites that have removed or disabled File Station 5 are unaffected even if other NAS services remain exposed.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network-reachable, low-complexity exploitation requiring only a low-privilege account and no user interaction, with VC:H/VI:H/VA:H reflecting full compromise of confidentiality, integrity, and availability on the vulnerable subsystem - yielding the 8.7 score. The vendor's own description, however, is more conservative, citing only memory modification or process crash rather than confirmed code execution; this gap between scored impact and described impact is worth noting. EPSS and SSVC data were not provided, the CVE is not in CISA KEV, and no public PoC is referenced, so the most likely real-world risk is post-authentication denial of service or instability against internet-exposed NAS units, with code-execution potential plausible given CWE-121 but not vendor-confirmed.

An attacker phishes, brute-forces, or otherwise obtains credentials for any low-privilege NAS user on an internet-reachable QNAP appliance, logs in to File Station 5 over HTTP(S), and submits a crafted request - likely an oversized filename, path, or parameter - that overflows a stack buffer in the File Station handler. The immediate result is memory corruption causing the File Station process to crash (denial of service); given CWE-121 and the high integrity/confidentiality impact in the CVSS vector, escalation to code execution in the File Station process context is plausible but not confirmed by the vendor description.