PatchSiren cyber security CVE debrief
CVE-2026-22899 Qnap CVE debrief
CVE-2026-22899 is a NULL pointer dereference vulnerability affecting QNAP File Station 6. A remote attacker with a user account can exploit this vulnerability to launch a denial-of-service (DoS) attack. The vulnerability has been fixed in File Station 5 version 5.5.6.5208 and later.
- Vendor
- Qnap
- Product
- File Station
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-10
- Original CVE updated
- 2026-06-12
- Advisory published
- 2026-06-10
- Advisory updated
- 2026-06-12
Who should care
Users of QNAP File Station 6, particularly those with remote access or user accounts that could be compromised.
Technical summary
The vulnerability, identified as CWE-476, allows for a denial-of-service (DoS) attack if a remote attacker gains a user account. The CVSS score for this vulnerability is 5.3, indicating a medium severity.
Defensive priority
Medium
Recommended defensive actions
- Update File Station 5 to version 5.5.6.5208 or later.
- Restrict access to File Station 6 to trusted user accounts.
- Monitor for suspicious activity on File Station 6.
Evidence notes
The CVE record and details were obtained from the official CVE.org and NVD databases.
Official resources
-
CVE-2026-22899 CVE record
CVE.org
-
CVE-2026-22899 NVD detail
NVD
-
Source item URL
nvd_modified
-
Source reference
[email protected] - Broken Link
CVE-2026-22899 was published on 2026-06-10T04:17:16.270Z and modified on 2026-06-12T13:49:59.763Z.