CVE-2025-66276
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The vulnerability affects QTS (QNAP operating system). The vendor confirms QuTS hero is not affected. The fix is included in QTS 5.2.7.3256 build 20250913 and later.
Risk Assessment
An attacker could exploit the vulnerability in QTS to compromise the QNAP device, potentially leading to data loss or takeover.
Recommendation
Upgrade QTS to version 5.2.7.3256 or later.
Other vulnerabilities in QTS
See all- CVE-2017-7876Critical
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application.
- CVE-2025-62850High
A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud, and QuTS hero. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.
Original NVD description (English source)
QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS