Which versions of QNAP File Station 5 are affected by CVE-2026-26239?

QNAP File Station 5 (versions 5.5.0-5.5.6.5208) is vulnerable to a buffer overflow that allows authenticated users to crash processes and corrupt data on NAS systems; no public exploit identified at…. A patch is available.

How to fix or mitigate CVE-2026-26239?

24 hours: Identify all QNAP File Station 5 deployments and document current software versions. 7 days: Apply vendor-released patch to all systems running versions 5.5.0 through 5.5.6.5208; validate patch in non-production environment before production deployment. 30 days: Complete patching of all affected systems and perform post-patch functionality verification.

QNAP File Station 5 CVE-2026-26239

Q: What is the CVSS score of CVE-2026-26239?

CVE-2026-26239 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35979 MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-06-10 qnap

GHSA-82g9-7jh6-77wg

Buffer Overflow Stack Overflow File Station 5 Qnap Systems Inc

6.3

CVSS 4.0 · Vendor: qnap

Severity by source

Vendor (qnap) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (qnap) · only source for this CVE.

CVSS VectorVendor: qnap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 23, 2026 - 09:22 NVD

HIGH MEDIUM

CVSS changed

Jul 23, 2026 - 09:22 NVD

8.7 (HIGH) 6.3 (MEDIUM)

Analysis Generated

Jun 10, 2026 - 06:20 vuln.today

Patch available

Jun 10, 2026 - 05:01 EUVD

CVSS changed

Jun 10, 2026 - 04:22 NVD

8.7 (HIGH)

CVE Published

Jun 10, 2026 - 03:15 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

AnalysisAI

Stack-based buffer overflow in QNAP File Station 5 versions 5.5.0 through 5.5.6.5208 allows authenticated remote attackers to corrupt memory and crash processes on affected NAS deployments. CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability, though exploitation requires valid user credentials (PR:L). No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.

Technical ContextAI

File Station 5 is QNAP's web-based file management application bundled with QTS/QuTS hero NAS operating systems, providing browser-driven file browsing, sharing, and transfer. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), a memory-safety defect where input exceeding a fixed-size stack buffer overwrites adjacent stack memory, potentially corrupting return addresses, local variables, or saved frame pointers. The CPE cpe:2.3:a:qnap_systems_inc.:file_station_5:*:*:*:*:*:*:*:* and the vendor tags (Stack Overflow, Buffer Overflow) confirm a classic stack-smashing primitive in the File Station code path rather than a heap or integer-overflow variant.

RemediationAI

Vendor-released patch: File Station 5 version 5.5.6.5208 or later - upgrade via the QNAP App Center on each affected NAS, as directed in QSA-26-37 (https://www.qnap.com/en/security-advisory/qsa-26-37). If immediate patching is not possible, compensating controls include disabling or uninstalling the File Station 5 app from the App Center until updated (trade-off: users lose the browser-based file manager and must use SMB/AFP/FTP or Qfile clients), restricting access to the File Station web interface to a management VLAN or VPN via the QNAP firewall, and auditing and reducing the number of low-privilege NAS user accounts since PR:L authentication is the gating prerequisite. Do not expose the NAS administrative web UI directly to the internet.