CVE-2026-41539
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms ...
Affects 0 products across 1 vendor.
Attacker injects malicious scripts into web pages viewed by other users, executing in the victim's browser context.
A stored or reflected cross-site scripting (XSS) vulnerability affects multiple QNAP operating system versions (QTS and QuTS hero), allowing remote attackers to inject and execute malicious scripts in the context of authenticated user sessions. Attackers can leverage this to bypass security mechanisms, steal session tokens, or exfiltrate application data. In OT environments where QNAP NAS devices are used for historian data storage, backup, or file sharing, exploitation could lead to credential theft and lateral movement into sensitive ICS network segments.
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-41539?
Is CVE-2026-41539 actively exploited?
How do I remediate CVE-2026-41539?
What systems are affected by CVE-2026-41539?
| CVE ID | CVE-2026-41539 |
|---|---|
| Published | 2026-06-09 |
| Last Modified | 2026-06-09 |
| ICS Relevance | 55% |
| Weakness (CWE) | |
| Source | NVD |
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3500 build 20260520 and later
Source: NIST NVD / MITRE CVE Database
| Vendor | Product | Fixed Version |
|---|---|---|
| Qnap | — | — |
Fixed Version: QTS 5.2.9.3492 build 20260507; QuTS hero h5.2.9.3499 build 20260514; QuTS hero h5.3.4.3500 build 20260520; QuTS hero h6.0.0.3500 build 20260520
Patches resolve the XSS vulnerability by implementing proper input validation and output encoding in the affected QNAP web application components across QTS and QuTS hero operating system lines, preventing attackers from injecting malicious scripts that execute in authenticated user browser sessions.
View Vendor Advisory →| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Deploy a Web Application Firewall (WAF) or reverse proxy with XSS filtering rules in front of all QNAP NAS web management interfaces. Block inbound HTTP/HTTPS traffic to QNAP management ports (80, 443, 8080) from any source outside of designated administrator workstation IP ranges at the OT DMZ perimeter firewall. Additionally, apply egress filtering to prevent NAS devices from initiating outbound connections to external hosts.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.
Join free →