QNAP QTS EUVD-2026-35977

Exploitation requires a valid QNAP administrator account on the target NAS (CVSS PR:H) and network reachability to the device's administrative web interface (AV:N); no victim user interaction is needed (UI:N) and attack complexity is low (AC:L). The vulnerable code path exists in QTS builds before 5.2.9.3492 build 20260507 and QuTS hero builds before h5.2.9.3499 build 20260514, so devices already updated past those builds are not exploitable. The principal limiting factor is the administrator credential requirement - without one, the bug cannot be reached, which is why this is realistically a post-auth privilege/command-execution primitive rather than an internet-wide remote-takeover bug.

Signals point in opposite directions and must be weighed carefully. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H produces a high 8.6 score, but PR:H means the attacker must already be an administrator - the single largest mitigating factor and the reason real-world risk is far below what the headline number suggests. There is no EPSS score provided, no CISA KEV listing, and no public PoC identified at time of analysis, so this is not currently a mass-exploitation candidate. The realistic threat models are post-compromise privilege amplification (turning a stolen admin web session into a root shell), insider abuse, and chaining with a separate authentication-bypass or credential-theft bug; treat it as a meaningful but second-tier patch priority unless the device is internet-exposed with weak admin credentials.

An attacker who has phished, brute-forced, or replayed a stolen administrator credential logs into the QNAP web UI over the network and submits a crafted value to a vulnerable admin endpoint that embeds the input into a shell command. The injected metacharacters cause the NAS to execute arbitrary OS commands with the privileges of the underlying service, giving the attacker a persistent foothold on the appliance and access to all stored data. No user interaction by a victim is required (UI:N) and complexity is low (AC:L), so the only real gate is obtaining administrator credentials in the first place.