Cross-Site Scripting Vulnerability in QNAP Network & Virtual Switch
CVE-2026-22896

6.2MEDIUM

Key Information:

Vendor

QNAP
Status
Network & Virtual Switch
Vendor
CVE Published:
15 October 2026

What is CVE-2026-22896?

A cross-site scripting (XSS) vulnerability has been identified in QNAP's Network & Virtual Switch. This issue allows a remote attacker, equipped with administrator account permissions, to exploit the vulnerability and introduce malicious scripts into webpages viewed by other users. Such exploitation could compromise the integrity of user sessions and lead to unauthorized actions within the affected systems. It is crucial for users to upgrade to the latest versions mentioned to mitigate these risks effectively.

Affected Version(s)

Network & Virtual Switch QTS 5.1.x

Network & Virtual Switch QTS 5.2.x

Network & Virtual Switch QuTS cloud c5.2.x

References

https://www.qnap.com/en/release-notes/qts/5.1.8.2823/2024...
release-notes
https://www.qnap.com/en/release-notes/qts/5.2.1.2930/2024...
release-notes
https://www.qnap.com/en/release-notes/qutscloud/c5.2.4.30...
release-notes

CVSS V4

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Solanki Milan
.