CVE-2026-26241

N/A

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the v...

Affects 0 products across 1 vendor.

CVSS v45.3
EPSS0.3%
Percentile24th
PatchUnknown
CWE Weakness Definitions
CWE-121: Stack-Based Buffer Overflow

Buffer overflow corrupting the program stack, typically overwriting the return address for code execution.

◆ SAGE Intelligence — CITED Relevance Research Team

QNAP File Station 5, a web-based file management application commonly deployed on NAS devices used in industrial and corporate environments, contains a buffer overflow vulnerability that allows remote attackers to corrupt memory or crash processes. An unauthenticated or authenticated remote attacker could exploit this to cause denial of service or potentially achieve arbitrary code execution on the underlying host. In OT environments where QNAP NAS devices serve as data historians, file transfer nodes, or engineering workstation storage, successful exploitation could disrupt operations or provide a pivot point into the operational network.

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-26241?
QNAP File Station 5, a web-based file management application commonly deployed on NAS devices used in industrial and corporate environments, contains a buffer overflow vulnerability that allows remote attackers to corrupt memory or crash processes. An unauthenticated or authenticated remote attacker could exploit this to cause denial of service or potentially achieve arbitrary code execution on the underlying host. In OT environments where QNAP NAS devices serve as data historians, file transfer
Is CVE-2026-26241 actively exploited?
No confirmed active exploitation of CVE-2026-26241 as of 2026-06-24.
How do I remediate CVE-2026-26241?
Update to File Station 5 5.5.6.5243 or later. Remediation of a buffer overflow condition in File Station 5 that allowed remote attackers to send crafted requests resulting in memory corruption or process crashes; upgrade to 5.5.6.5243 or later resolves the vulnerability. Advisory: https://www.qnap.com/en/security-advisory
What systems are affected by CVE-2026-26241?
CVE-2026-26241 affects: Qnap.
Vulnerability Details
CVE IDCVE-2026-26241
Published2026-06-10
Last Modified2026-06-10
ICS Relevance70%
Weakness (CWE)
SourceNVD
Official Description

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

Source: NIST NVD / MITRE CVE Database

Affected Products
VendorProductFixed Version
Qnap —
Remediation

Fixed Version: File Station 5 5.5.6.5243

Remediation of a buffer overflow condition in File Station 5 that allowed remote attackers to send crafted requests resulting in memory corruption or process crashes; upgrade to 5.5.6.5243 or later resolves the vulnerability.

View Vendor Advisory →
Threat Intelligence
● Threat Intelligence Validated: July 2026 | Threat Age: 32 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
● Virtual Patch — CITED Relevance SAGE Engine LOW CONFIDENCE

Deploy IPS rules at the perimeter firewall and any internal DMZ segments to detect and block oversized HTTP/HTTPS POST requests targeting QNAP File Station URI paths. Block all inbound access to QNAP management ports (80, 443, 8080, 8443) from untrusted external networks. If File Station is not required to be internet-facing, block all external access entirely and restrict to management VLAN only. For OT environments, ensure no QNAP NAS devices are directly reachable from the OT network without a properly configured industrial DMZ.

No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.

Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.

Related CVEs affecting Qnap
CVE-2017-7876 10.0 This command injection vulnerability in QTS allows attackers to run arbitrary... CVE-2024-32766 10.0 An OS command injection vulnerability has been reported to affect several QNA... CVE-2024-32764 9.9 A missing authentication for critical function vulnerability has been reporte... CVE-2017-17033 9.8 A buffer overflow vulnerability in password function in QNAP QTS version 4.2.... CVE-2017-17028 9.8 A buffer overflow vulnerability in external device function in QNAP QTS versi...
View all Qnap CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.

Join free →