Refine your search

1 vulnerability found for Network & Virtual Switch by QNAP Systems Inc.

CVE-2026-22896 (GCVE-0-2026-22896)
Vulnerability from cvelistv5
Published
2026-10-15 06:58
Modified
2026-10-15 18:25
Severity ?
6.2 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
CWE
Summary
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later
References
Impacted products
Vendor Product Version
QNAP Systems Inc. Network & Virtual Switch Version: QTS 5.1.x   < QTS 5.1.8.2823 build 20240712
Version: QTS 5.2.x   < QTS 5.2.1.2930 build 20241025
Version: QuTS cloud c5.2.x   < QuTS cloud c5.2.4.3041 build 20250211
Version: QuTS hero h5.1.x   < QuTS hero h5.1.8.2823 build 20240712
Version: QuTS hero h5.2.x   < QuTS hero h5.2.1.2929 build 20241025
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22896",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:25:15.173148Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:25:22.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Network \u0026 Virtual Switch",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "QTS 5.1.8.2823 build 20240712",
              "status": "affected",
              "version": "QTS 5.1.x",
              "versionType": "custom"
            },
            {
              "lessThan": "QTS 5.2.1.2930 build 20241025",
              "status": "affected",
              "version": "QTS 5.2.x",
              "versionType": "custom"
            },
            {
              "lessThan": "QuTS cloud c5.2.4.3041 build 20250211",
              "status": "affected",
              "version": "QuTS cloud c5.2.x",
              "versionType": "custom"
            },
            {
              "lessThan": "QuTS hero h5.1.8.2823 build 20240712",
              "status": "affected",
              "version": "QuTS hero h5.1.x",
              "versionType": "custom"
            },
            {
              "lessThan": "QuTS hero h5.2.1.2929 build 20241025",
              "status": "affected",
              "version": "QuTS hero h5.2.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Solanki Milan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A cross-site scripting (XSS) vulnerability has been reported to affect Network \u0026amp; Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following version:\u003cbr\u003eNetwork \u0026amp; Virtual Switch in QTS 5.1.8.2823 build 20240712 and later\u003cbr\u003eNetwork \u0026amp; Virtual Switch in QTS 5.2.1.2930 build 20241025 and later\u003cbr\u003eNetwork \u0026amp; Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later\u003cbr\u003eNetwork \u0026amp; Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later\u003cbr\u003eNetwork \u0026amp; Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later"
            }
          ],
          "value": "A cross-site scripting (XSS) vulnerability has been reported to affect Network \u0026 Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code.\n\nWe have already fixed the vulnerability in the following version:\nNetwork \u0026 Virtual Switch in QTS 5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QTS 5.2.1.2930 build 20241025 and later\nNetwork \u0026 Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T07:56:30.453Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.qnap.com/en/release-notes/qts/5.1.8.2823/20240712"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.qnap.com/en/release-notes/qts/5.2.1.2930/20241025"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.qnap.com/en/release-notes/qutscloud/c5.2.4.3041/20250211"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.qnap.com/en/release-notes/quts_hero/h5.1.8.2823/20240712"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.qnap.com/en/release-notes/quts_hero/h5.2.1.2929/20241025"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following version:\u003cbr\u003eNetwork \u0026 Virtual Switch in QTS 5.1.8.2823 build 20240712 and later\u003cbr\u003eNetwork \u0026 Virtual Switch in QTS 5.2.1.2930 build 20241025 and later\u003cbr\u003eNetwork \u0026 Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later\u003cbr\u003eNetwork \u0026 Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later\u003cbr\u003eNetwork \u0026 Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later"
            }
          ],
          "value": "We have already fixed the vulnerability in the following version:\nNetwork \u0026 Virtual Switch in QTS 5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QTS 5.2.1.2930 build 20241025 and later\nNetwork \u0026 Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Stored XSS via Interface Name in Network \u0026 Virtual Switch App",
      "x_generator": {
        "engine": "QNAP PSIRT cve_tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2026-22896",
    "datePublished": "2026-10-15T06:58:38.222Z",
    "dateReserved": "2026-01-13T07:49:08.783Z",
    "dateUpdated": "2026-10-15T18:25:22.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}