CVE-2026-41539

Published: Giu 09, 2026 Last Modified: Giu 12, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 6,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none

Description

AI Translation Available

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following versions:
QTS 5.2.9.3492 build 20260507 and later
QuTS hero h5.2.9.3499 build 20260514 and later
QuTS hero h5.3.4.3500 build 20260520 and later
QuTS hero h6.0.0.3500 build 20260520 and later

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0007
Percentile
0,2th
Updated

EPSS Score Trend (Last 6 Days)

79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Confidentiality Integrity Availability
Potential Impacts:
Bypass Protection Mechanism Read Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: AI/ML, Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.9.3410
cpe:2.3:o:qnap:quts_hero:h5.2.9.3410:build_20260214:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.3.1.3250
cpe:2.3:o:qnap:quts_hero:h5.3.1.3250:build_20250912:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.7.3297
cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.7.3256
cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.4.3079
cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.8.3359
cpe:2.3:o:qnap:qts:5.2.8.3359:build_20251225:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.0.2782
cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.9.3492
cpe:2.3:o:qnap:quts_hero:h5.2.9.3492:build_20260507:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.0.2744
cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.8.3321
cpe:2.3:o:qnap:quts_hero:h5.2.8.3321:build_20251117:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.0.2782
cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.7.3297
cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.6.3195
cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.3.0.3115
cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.4.3070
cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.0.2851
cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.7.3256
cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.4.3079
cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h6.0.0.3382
cpe:2.3:o:qnap:quts_hero:h6.0.0.3382:build_20260122:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h6.0.0.3397
cpe:2.3:o:qnap:quts_hero:h6.0.0.3397:build_20260206:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.0.2802
cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.2.2950
cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.5.3138
cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.3.3.3424
cpe:2.3:o:qnap:quts_hero:h5.3.3.3424:build_20260305:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.0.2802
cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.4.3070
cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.1.2940
cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.9.3410
cpe:2.3:o:qnap:qts:5.2.9.3410:build_20260214:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.3.2.3354
cpe:2.3:o:qnap:quts_hero:h5.3.2.3354:build_20251225:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.3.3006
cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.4.3092
cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.0.2823
cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.0.2860
cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.8.3359
cpe:2.3:o:qnap:quts_hero:h5.2.8.3359:build_20251225:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.3.1.3292
cpe:2.3:o:qnap:quts_hero:h5.3.1.3292:build_20251024:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.8.3350
cpe:2.3:o:qnap:qts:5.2.8.3350:build_20251216:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.0.2851
cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.6.3195
cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h6.0.0.3324
cpe:2.3:o:qnap:quts_hero:h6.0.0.3324:build_20251125:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.9.3451
cpe:2.3:o:qnap:qts:5.2.9.3451:build_20260327:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.0.2823
cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.5.3145
cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h6.0.0.3459
cpe:2.3:o:qnap:quts_hero:h6.0.0.3459:build_20260409:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.3.3006
cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.0.2737
cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.0.2789
cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.1.2929
cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.3.0.3145
cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.6.3229
cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.1.2930
cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.8.3332
cpe:2.3:o:qnap:qts:5.2.8.3332:build_20251128:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.8.3350
cpe:2.3:o:qnap:quts_hero:h5.2.8.3350:build_20251216:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.3.0.3192
cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Quts Hero by Qnap

Product Information
Vendor Qnap
Product Quts Hero
Version h5.2.2.2952
cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.0.2737
cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Qts by Qnap

Product Information
Vendor Qnap
Product Qts
Version 5.2.0.2860
cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.qnap.com/en/security-advisory/qsa-26-31
https://www.qnap.com/en/security-advisory/qsa-26-31