An application uses a fixed, hard‑coded cryptographic key for encryption, which allows an attacker to decrypt protected data or bypass security controls. The weakness is identified as CWE‑321 and could let remote attackers compromise backup data and potentially the host system. No other privileges or code execution are explicitly stated, but the loss of confidentiality or integrity fundamentally undermines the security of backups.

The vulnerability affects QNAP Systems Inc. products HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. Versions prior to HBS 3 26.4.0.521, Hybrid Backup Sync 26.4.0.521, and Hybrid Backup Sync 26.4.1.563 are impacted; the issue has been fixed in those and later releases.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is not available, and it is not listed in CISA's KEV catalog. The likely attack vector is remote, through the backup sync service, and requires the ability to send malicious requests or data to the affected host. Even in the absence of publicly known exploits, the high severity and the nature of the loss justify immediate attention.