Brand

QNAP: actively exploited vulnerabilities

12 vulnerabilities in QNAP products (NAS (QTS / QuTS hero), Photo Station, Helpdesk…) are in CISA’s catalog of exploited vulnerabilities. Last added: December 21, 2023.

QNAP security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

0 vulnerabilities added in the last 12 months
12 exploited vulnerabilities in the catalog, in total
0 added in the last 30 days

By category

Add just one QNAP category to your radar, or open its page.

Backup, storage and NAS 11 vulnerabilities
Home and small-office routers, cameras and IoT 1 vulnerability

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

NAS (QTS / QuTS hero) 6 vulnerabilities · Backup and NAS
Photo Station 4 vulnerabilities · Backup and NAS
Helpdesk 1 vulnerability · Backup and NAS
VioStor NVR 1 vulnerability · Home routers and IoT

Names used by CISA: QNAP, QNAP Systems. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this QNAP list.

Rank 1QNAP Photo Station
CVE-2019-7192
RansomwareCVE from 2019, added in 2022
QNAP Photo Station Improper Access Control Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 8, 2022
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 2QNAP NAS (QTS / QuTS hero)
CVE-2019-7193
RansomwareCVE from 2019, added in 2022
QNAP QTS Improper Input Validation Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 8, 2022
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 3QNAP Photo Station
CVE-2019-7194
RansomwareCVE from 2019, added in 2022
QNAP Photo Station Path Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 8, 2022
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 4QNAP Photo Station
CVE-2019-7195
RansomwareCVE from 2019, added in 2022
QNAP Photo Station Path Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 8, 2022
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 5QNAP NAS (QTS / QuTS hero)
CVE-2018-19949
RansomwareCVE from 2018, added in 2022
QNAP NAS File Station Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
May 24, 2022
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 6QNAP NAS (QTS / QuTS hero)
CVE-2020-2509
CVE from 2020, added in 2022
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Apr 11, 2022
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 7QNAP NAS (QTS / QuTS hero)
CVE-2021-28799
Ransomware
QNAP NAS Improper Authorization Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 31, 2022
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 8QNAP Helpdesk
CVE-2020-2506
CVE from 2020, added in 2022
QNAP Helpdesk Improper Access Control Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 25, 2022
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 9QNAP Photo Station
CVE-2022-27593
Ransomware
QNAP Photo Station Externally Controlled Reference Vulnerability
Added more than a year ago: ranked by severity.
Added
Sep 8, 2022
CISA deadline
21 days
CVSS severity
9.1 (critical)
Rank 10QNAP VioStor NVR
CVE-2023-47565
QNAP VioStor NVR OS Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Dec 21, 2023
CISA deadline
21 days
CVSS severity
8.8 (high)

Show 2 more vulnerabilities

Rank 11QNAP NAS (QTS / QuTS hero)
CVE-2018-19953
RansomwareCVE from 2018, added in 2022
QNAP NAS File Station Cross-Site Scripting Vulnerability
Added more than a year ago: ranked by severity.
Added
May 24, 2022
CISA deadline
21 days
CVSS severity
6.1 (medium)
Rank 12QNAP NAS (QTS / QuTS hero)
CVE-2018-19943
RansomwareCVE from 2018, added in 2022
QNAP NAS File Station Cross-Site Scripting Vulnerability
Added more than a year ago: ranked by severity.
Added
May 24, 2022
CISA deadline
21 days
CVSS severity
5.4 (medium)

Get new QNAP vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.

By category

Affected products

Patch first

Follow and verify