A command injection flaw in QNAP QTS and QuTS hero allows a remote attacker who has obtained an administrator account to execute arbitrary system commands. The vulnerability is identified as a CWE‑78 type injection, which can lead to full compromise of the affected device, compromised data confidentiality, integrity, and availability, and potential lateral movement within the network if administrative rights are used.

The flaw affects QNAP Systems Inc.’s QTS and QuTS hero operating systems. Any build older than the following fixed releases is vulnerable: QTS 5.2.9.3410 build 20260214 and later, QuTS hero h5.2.9.3410 build 20260214 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3459 build 20260409 and later.

The CVSS score of 8.6 marks the vulnerability as high severity. Although the EPSS score is not available and it is not listed in CISA KEV, the attack requires an administrator credential that is typically protected by strong authentication. Once the attacker gains that privilege, the command injection enables unrestricted command execution, which could be exploited immediately over the network if web interfaces or remote services are exposed.