CVE Intelligence
Analysis AI-assisted

CVE-2026-22897: QNAP QuNetSwitch OS command injection

CVE-2026-22897 is an OS command injection flaw (CWE-78) in QuNetSwitch that, according to the record, lets remote attackers execute arbitrary commands. NVD rates it CVSS 3.1 9.8 (critical), and the vendor states it is fixed in version 2.0.4.0415 and later. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

QuNetSwitch is affected by an OS command injection weakness (CWE-78). According to the record, remote attackers can exploit it to execute arbitrary commands. QNAP published the issue as advisory QSA-26-11 and states that version 2.0.4.0415 and later contain the fix.

Impact

The record describes arbitrary command execution by remote attackers. NVD scores the issue at CVSS 3.1 9.8 (critical), with a vector indicating network access, low complexity, no privileges, no user interaction, and high confidentiality, integrity and availability impact. QNAP's own CVSS 4.0 score is 8.1.

Affected products and versions

  • The record lists the products as Qnap Qunetswitch and QNAP Systems Inc. QuNetSwitch.
  • Recorded ranges: from 2.0.1.13077 up to before 2.0.4.0415, and from 2.0.x up to before 2.0.4.0415.
  • The vendor states the fix is in 2.0.4.0415 and later.

The two recorded ranges do not start at the same point, so administrators should confirm their exact build against the vendor advisory.

Exploitation status

The record shows no CISA KEV listing for this CVE. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.0108 (about 1.08 percent), and the SSVC exploitation field is recorded as none, while automatable is recorded as yes.

Remediation and mitigation

  • Update QuNetSwitch to 2.0.4.0415 or later, as stated by the vendor.
  • Review QNAP advisory QSA-26-11 for official guidance and any interim measures.
  • Limit exposure of management interfaces to trusted networks until the update is applied.
  • Inventory all QuNetSwitch instances and verify their build versions.

Detection guidance

  • Review logs for unexpected system-level or administrative activity on affected devices.
  • Watch for unexpected outbound connections or newly created processes originating from the appliance.
  • Compare device configuration and software state against a known-good baseline after patching.

Limitations of the available information

  • The fixes field in the record is empty, but the vendor description names the fixed version. The missing field does not mean no fix exists.
  • The record contains no technical details, proof-of-concept data or independent testing results.
  • The affected ranges in the record are not fully aligned, so exact vulnerable builds are uncertain.
  • The record does not state whether a workaround exists beyond the vendor advisory.

Frequently asked questions

Is CVE-2026-22897 being actively exploited?

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. Keep monitoring the vendor advisory and KEV for changes.

Which QuNetSwitch version fixes this issue?

The vendor description states that version 2.0.4.0415 and later contain the fix. Check the QNAP advisory QSA-26-11 to confirm the details for your environment.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.