This vulnerability (CVE-2026-22893) is a command injection flaw (CWE-78) in QNAP QTS operating system. An attacker who already has administrator access can exploit this vulnerability to execute arbitrary commands remotely. The vulnerability affects QTS 5.2.0 and earlier versions prior to the fixed releases. The vendor has released patches in QTS 5.2.9.3410 build 20260214 and later, and in QuTS hero h5.2.9.3410 build 20260214, h5.3.4.3500 build 20260520, and h6.0.0.3459 build 20260409 and later. The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

If exploited, an attacker with administrator privileges can execute arbitrary commands on the affected QNAP system, potentially leading to full system compromise. This could allow unauthorized control over the device, data theft, or disruption of services. The vulnerability does not require user interaction and can be exploited remotely over the network.

The vulnerability has been fixed by QNAP in QTS 5.2.9.3410 build 20260214 and later, and in QuTS hero h5.2.9.3410 build 20260214, h5.3.4.3500 build 20260520, and h6.0.0.3459 build 20260409 and later. Users should upgrade affected systems to these versions or later to remediate the vulnerability. No other mitigation guidance is provided, and patching is the recommended action.