OS Command Injection Vulnerability in Notes Station 3 by QNAP
CVE-2026-34007

6.9MEDIUM

Key Information:

Vendor

QNAP
Status
Notes Station 3
Vendor
CVE Published:
15 October 2026

What is CVE-2026-34007?

An OS command injection vulnerability has been identified in QNAP's Notes Station 3 software. This flaw allows remote attackers to execute arbitrary commands on the affected systems, potentially compromising the security and integrity of the device and its data. To mitigate risk, users are advised to update to Notes Station 3 version 3.9.11 or later, where the vulnerability has been addressed.

Affected Version(s)

Notes Station 3 3.9.x < 3.9.11

References

https://www.qnap.com/en/app-release-notes?keyword=Notes%2...
release-notes

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Runic Labs
.