CVE-2026-24716 is a NULL pointer dereference vulnerability in QNAP Systems Inc. QTS that allows a remote attacker with administrator privileges to trigger a denial-of-service (DoS) attack. The issue affects QTS versions prior to 5.2.9.3492 and certain QuTS hero versions before their respective fixed builds. The vulnerability is identified as CWE-476 and has a CVSS 4.0 base score of 5.1, indicating medium severity. The vulnerability does not require user interaction and has low complexity for exploitation but requires high privileges (administrator).

Successful exploitation results in a denial-of-service condition, disrupting the availability of the affected QNAP system. The attacker must already have administrator access to exploit this vulnerability, limiting the scope of impact to privileged users.

The vulnerability has been fixed in QTS 5.2.9.3492 build 20260507 and later, QuTS hero h5.2.9.3499 build 20260514 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3459 build 20260409 and later. Users should upgrade to these versions or later to remediate the issue. No additional mitigation steps are indicated by the vendor.