OS Command Injection Vulnerability in HybridDesk Station by QNAP
CVE-2026-47786

9.3CRITICAL

Key Information:

Vendor

QNAP
Status
Hybriddesk Station
Vendor
CVE Published:
15 October 2026

What is CVE-2026-47786?

A critical OS command injection vulnerability has been identified in HybridDesk Station, which could be exploited by remote attackers to execute arbitrary commands on affected systems. Users are advised to update to HybridDesk Station versions 4.2.23 and later or 4.3.4 and later to mitigate potential risks associated with this vulnerability.

Affected Version(s)

HybridDesk Station 4.2.x < 4.2.23

HybridDesk Station 4.3.x < 4.3.4

References

https://www.qnap.com/en/app-release-notes?keyword=HybridD...
release-notes

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

shaolin
.