This vulnerability is a CWE-79 cross-site scripting (XSS) flaw in QNAP QTS operating systems. Remote attackers can exploit this vulnerability to bypass security controls or access application data improperly. The vendor has released fixed versions for QTS and QuTS hero platforms, specifically QTS 5.2.9.3492 build 20260507 and later, QuTS hero h5.2.9.3499 build 20260514 and later, QuTS hero h5.3.4.3500 build 20260520 and later, and QuTS hero h6.0.0.3500 build 20260520 and later. No known exploits in the wild have been reported at this time.

Successful exploitation of this XSS vulnerability could allow remote attackers to bypass security mechanisms or read sensitive application data. The CVSS score of 6.3 reflects a medium impact, with network attack vector, low attack complexity, no privileges required, but requiring user interaction. The vulnerability affects confidentiality, integrity, and availability to a high degree.

The vulnerability has been fixed in QTS 5.2.9.3492 build 20260507 and later versions, as well as in specified QuTS hero versions. Users and administrators should upgrade affected QTS and QuTS hero systems to these fixed versions or later to remediate this vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation actions are indicated.