The vulnerability is a command injection flaw that permits a remote attacker with administrative privileges to execute arbitrary operating system commands on a QNAP device, leading to full remote code execution and compromise of confidentiality, integrity, and availability. The weakness is defined as CWE‑78.

The flaw affects QNAP Systems Inc. products QTS and QuTS hero. Versions prior to QTS 5.2.9.3492 build 20260507 and QuTS hero h5.2.9.3499 build 20260514 are susceptible. All systems running those older releases should be considered vulnerable until upgraded.

The flaw carries a CVSS score of 8.6, indicating high severity. Although the EPSS score is not currently available, the lack of a KEV listing does not guarantee low risk; the attacker still needs administrator credentials, which may be obtained through phishing or credential harvesting. The attack vector is remote network, making the vulnerability exploitable from outside the local network if administrative interfaces are exposed. Once exploited, the attacker can gain full control of the device.