QNAP File Station EUVD-2026-35974

The attacker must possess a valid, authenticated user account on the QNAP NAS with access to File Station 5 (CVSS PR:L confirms low-privilege authentication is required). The description explicitly states 'if a remote attacker gains a user account' as the precondition for exploitation. No special administrative privileges, no specific non-default configuration, and no user interaction from a victim are required beyond this account. Exploitation is limited to authenticated users only - unauthenticated remote attackers cannot trigger this vulnerability. The impact is also bounded to local availability (VA:L) of the vulnerable system, with no lateral impact to other network systems (SA:N/SC:N).

The CVSS 4.0 base score of 5.3 (Medium) is well-calibrated to the actual risk profile. The impact metrics (VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) show availability is only partially degraded at the vulnerable-system level, with no downstream or cross-system propagation - limiting the blast radius compared to a full RCE or data-exfiltration class vulnerability. The PR:L requirement is a meaningful barrier: the attacker must first obtain or possess a valid NAS user account before exploitation is possible. No EPSS data was supplied in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no known public exploit code, making near-term opportunistic exploitation unlikely. For shared or multi-tenant QNAP environments where external users have accounts, the threat of a malicious or compromised user intentionally disrupting other tenants is a realistic concern; for single-user home NAS deployments, the practical risk is low. The discrepancy between 'File Station 6' in the CVE description and 'File Station 5' in the CPE and patch data should be verified with QNAP's advisory before determining full scope.

An attacker who holds or has obtained a low-privilege QNAP NAS user account authenticates to File Station 5 over the network and submits a high volume of resource-intensive requests - such as repeated large directory listings, uploads, or other operations - without any imposed throttling limit. The cumulative resource consumption degrades or denies availability of File Station (or shared system resources) for other legitimate users and processes on the NAS. No public exploit code exists to mechanize this scenario at time of analysis, but the low complexity and no-prerequisite nature of the attack (beyond possessing an account) means manual exploitation requires minimal skill.