CVE-2026-22893
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to...
Affects 0 products across 1 vendor.
Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.
CVE-2026-22893 is a post-authentication command injection vulnerability affecting multiple QNAP NAS operating system versions (QTS and QuTS hero). An attacker who has obtained administrator-level credentials can inject and execute arbitrary OS commands on the underlying system. In OT environments where QNAP NAS devices are used for historian data storage, backup, or file sharing, successful exploitation could result in data exfiltration, ransomware deployment, or disruption of critical operational data repositories.
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-22893?
Is CVE-2026-22893 actively exploited?
How do I remediate CVE-2026-22893?
What systems are affected by CVE-2026-22893?
| CVE ID | CVE-2026-22893 |
|---|---|
| Published | 2026-06-10 |
| Last Modified | 2026-06-10 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Source | NVD |
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later
Source: NIST NVD / MITRE CVE Database
| Vendor | Product | Fixed Version |
|---|---|---|
| Qnap | — | — |
Fixed Version: QTS 5.2.9.3410 build 20260214; QuTS hero h5.2.9.3410 build 20260214; QuTS hero h5.3.4.3500 build 20260520; QuTS hero h6.0.0.3459 build 20260409
Patches sanitize user-supplied input in the affected OS components to prevent injection of shell metacharacters, eliminating the command injection vector accessible to authenticated administrator accounts across QTS and QuTS hero product lines.
View Vendor Advisory →| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Deploy inline IDS/IPS at the network perimeter and on OT DMZ segments to inspect HTTP/HTTPS traffic destined for QNAP management ports (8080, 443). Block POST requests to /cgi-bin/ or API endpoints containing shell metacharacters (semicolons, pipes, backticks, dollar signs) combined with known command strings. Additionally, restrict access to QNAP management interfaces at the firewall to a dedicated jump host or admin VLAN only, and enable SSL inspection if traffic is encrypted.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.
Join free →