CVE-2026-22896: CWE-79 in QNAP Systems Inc. Network & Virtual Switch
Description
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later
CVSS v4.0
Score 6.2medium
Affected software
QNAP Systems Inc.
Network & Virtual Switch
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-22896) is a CWE-79 cross-site scripting issue affecting QNAP's Network & Virtual Switch. An attacker with administrator privileges can inject malicious code via this vulnerability. The vendor has released fixes in QTS 5.1.8.2823 build 20240712 and later, QTS 5.2.1.2930 build 20241025 and later, QuTS cloud c5.2.4.3041 build 20250211 and later, QuTS hero h5.1.8.2823 build 20240712 and later, and QuTS hero h5.2.1.2929 build 20241025 and later.
Potential Impact
The impact is limited to scenarios where an attacker already has administrator access. The vulnerability allows injection of malicious code via XSS, which could lead to further compromise of the administrative interface. The CVSS 4.0 score is low (2.2), reflecting the requirement for high privileges and user interaction.
Mitigation Recommendations
The vulnerability has been officially fixed by the vendor in the specified versions of QTS, QuTS cloud, and QuTS hero. Users should upgrade to these fixed versions or later to remediate the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- qnap
- Date Reserved
- 2026-01-13T07:49:08.783Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad07e6f2cdf04f65612bc14
Added to database: 10/15/2026, 07:19:11 UTC
Last enriched: 10/15/2026, 07:33:48 UTC
Last updated: 10/15/2026, 19:04:20 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.