This vulnerability (CVE-2026-24719) is a command injection flaw (CWE-78) in QNAP QTS operating system. It allows a remote attacker who has already obtained administrator credentials to execute arbitrary commands on the system. The vulnerability affects QTS versions prior to 5.2.9.3492 build 20260507 and QuTS hero versions prior to h5.2.9.3499 build 20260514. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor has released fixed versions to address this issue.

An attacker with administrator privileges can leverage this vulnerability to execute arbitrary commands on the affected QNAP device, potentially leading to full system compromise. This impacts confidentiality, integrity, and availability of the system. However, exploitation requires prior administrative access, limiting the attack surface. No known exploits in the wild have been reported to date.

The vulnerability has been fixed in QTS 5.2.9.3492 build 20260507 and later, and QuTS hero h5.2.9.3499 build 20260514 and later. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, remediation depends on applying these official vendor patches. Patch status is confirmed by the vendor advisory embedded in the description.