QNAP Virtualization Station EUVD-2026-101982

Exploitation requires the attacker to first hold a valid (low-privilege) user account on the QNAP device running Virtualization Station - per PR:L and the description's 'gains a user account' - and the Virtualization Station application must be installed and in use (it is an optional add-on QKVM app, not a default NAS component). The attacker must be able to create or influence a symbolic link that a higher-privileged Virtualization Station file operation then follows (classic CWE-59 link-following). Limiting factors: authentication is required (not unauthenticated), the vulnerable app must be deployed, and success may depend on winning a symlink race or controlling a writable path consumed by the privileged process; no user interaction is needed (UI:N).

This is a credible, elevated-priority issue for environments running QNAP Virtualization Station, though not a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, 8.7 HIGH) indicates a network-reachable attack of low complexity that nonetheless requires a valid user account (PR:L) and, once triggered, yields high confidentiality, integrity, and availability impact - consistent with the description stating an attacker who 'gains a user account' can 'compromise the security of the system.' The CWE-59 link-following nature means impact typically stems from privileged file access/overwrite via symlink races, aligning with the full-impact CVSS. Key risk-tempering factors: no CISA KEV listing and no EPSS score are provided, and no public PoC is referenced, so there is no evidence of active or widespread exploitation. The lone 'Information Disclosure' tag understates the rated impact - the CVSS asserts high integrity AND availability impact (VI:H/VA:H), not merely disclosure, so defenders should treat this as a potential full-system-compromise primitive rather than a read-only data leak. Net: a real patch-worthy vulnerability gated by prior authentication, not a mass-exploitable unauthenticated RCE.

A remote attacker who has obtained (or been granted) a low-privilege user account on a QNAP NAS running Virtualization Station abuses improper symlink resolution: they plant a crafted symbolic link so that a privileged Virtualization Station operation reads from or writes to a file outside the intended path, letting them access or overwrite sensitive files and escalate to full system control. No public exploit code is referenced in the provided data, and attack complexity is rated low (AC:L).