PatchTheCVEqts vulnerabilities and fixes
Recent CVEs affecting qts, with upgrade or downgrade steps. 9 tracked.
qts has 9 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 9. Most recent: 2026-06-10. Highest priority: CVE-2025-66276 (score 45/100).
- CVE-2025-66276 CRITICAL 9.8 UPGRADE QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 b
- CVE-2025-66273 HIGH 7.2 UPGRADE UPGRADE A command injection vulnerability has been reported to affect several QNAP operating system versions
- CVE-2025-66279 HIGH 7.2 UPGRADE UPGRADE A command injection vulnerability has been reported to affect several QNAP operating system versions
- CVE-2026-22893 HIGH 7.2 UPGRADE UPGRADE A command injection vulnerability has been reported to affect several QNAP operating system versions
- CVE-2026-24719 HIGH 7.2 UPGRADE UPGRADE A command injection vulnerability has been reported to affect several QNAP operating system versions
- CVE-2025-66280 HIGH 7.2 UPGRADE UPGRADE An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system vers
- CVE-2025-66281 HIGH 7.2 UPGRADE UPGRADE A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions
- CVE-2026-24716 HIGH 7.2 UPGRADE UPGRADE A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions
- CVE-2026-24717 MEDIUM 6.5 UPGRADE UPGRADE A path traversal vulnerability has been reported to affect several QNAP operating system versions
FAQ
How do I fix qts vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is qts being exploited right now?
None of the tracked qts CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which qts CVE should I patch first?
CVE-2025-66276 currently ranks highest (45/100): QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 b.