CVE Intelligence
Analysis AI-assisted

CVE-2026-22898: QNAP QVR Pro - Missing Authentication for Critical Function

QNAP has reported a missing authentication for critical function vulnerability (CWE-306) in QVR Pro, which the record says can let remote attackers gain access to the system. The NVD assigns a CVSS score of 9.8 and the vendor states that QVR Pro 2.7.4.14 and later include the fix. The sources consulted do not show confirmed exploitation in the wild.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

QNAP published advisory QSA-26-07 covering a missing authentication for critical function vulnerability in QVR Pro, classified as CWE-306. The record states that remote attackers may use the flaw to gain access to the system, and that the fix is available in QVR Pro 2.7.4.14 and later.

Impact

  • The NVD base score is 9.8 (critical), and the vector in the record indicates network access, low complexity, no privileges and no user interaction required.
  • The record describes a total technical impact on confidentiality, integrity and availability, as reflected in the SSVC data.
  • The CNA (QNAP) lists a separate score of 9.3 under CVSS 4.0.

Affected products and versions

  • The record lists two affected entries for QVR Pro: one stated as from 2.7.1.1259 before 2.7.4.1485, and another stated as from an unspecified 2.7 branch before 2.7.4.14.
  • These two ranges are not fully consistent with each other, so the exact affected range should be confirmed in the QNAP advisory.
  • The vendor states that QVR Pro 2.7.4.14 and later include the fix.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog in the record.
  • The SSVC exploitation field is set to none, and the EPSS probability is 0.00695 (percentile 0.5245).
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade QVR Pro to version 2.7.4.14 or later, as stated by the vendor.
  • Verify the installed version against the QNAP advisory, since the affected ranges in the record are inconsistent.
  • Restrict access to the QVR Pro management interface to trusted networks while patching is scheduled, as a general defensive measure.

Detection guidance

  • Review access logs of QVR Pro for requests to administrative or critical functions from unexpected sources or without a valid session.
  • Monitor for unexpected new accounts, configuration changes or access to recordings on the system.

Limitations of the available information

  • The record does not identify the specific critical function affected.
  • The fixes field in the record is empty, although the description names the fixed version.
  • The EPSS date in the record is later than the publication date, and no independent exploit analysis was available in the sources consulted.

Frequently asked questions

What is CVE-2026-22898?

It is a missing authentication for critical function vulnerability (CWE-306) in QNAP QVR Pro, which the record says can allow remote attackers to gain access to the system.

Which version fixes the issue?

The vendor states that QVR Pro 2.7.4.14 and later include the fix. The affected ranges in the record are inconsistent, so check the QNAP advisory to confirm your exact version.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and the SSVC exploitation field is none. No confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.