A vulnerability in QNAP's QTS and QuTS hero operating systems allows a remote attacker with administrative credentials to perform arbitrary command execution. The flaw is a classic command injection, where the system executes system commands provided by the attacker. Depending on the level of privileges, this can compromise the entire device, exfiltrate data, or disrupt network services.

QNAP Systems Inc.'s QTS and QuTS hero platforms are affected. All versions before QTS 5.2.9.3410 build 20260214; QuTS hero h5.2.9.3410 build 20260214; QuTS hero h5.3.4.3500 build 20260520; and QuTS hero h6.0.0.3397 build 20260206 are vulnerable.

The CVSS score of 8.6 indicates high severity, and the vulnerability is classified as CWE-78. The EPSS score is not available, so exploitation probability is uncertain, but the attack requires an administrator account—a significant privilege dependency. After compromising or guessing an administrator credential, an attacker can send crafted input that is interpreted as a system command and executed with system privileges. The advisory is not listed in the CISA KEV. Because public exploits are not currently documented, the immediate risk is moderate to high, yet prompt mitigation is recommended to prevent potential abuse.