Six high-risk vulnerabilities patched in QNAP Video Station, update required

QNAP has released an update for Video Station, the media library app on its NAS devices, fixing six security vulnerabilities. All of the vulnerabilities affect versions of Video Station before 5.8.8; two are rated high with a CVSS score of 8.8. According to NVD records, exploiting these vulnerabilities requires an attacker to reach the device over the network and, in most scenarios, compromise a valid user account. So this is not a stand-alone remote “one-click” takeover, but the risk is serious for a NAS running with weak or default passwords.

Fixed vulnerabilities

CVE-2026-26244 and CVE-2026-26245 (CVSS 8.8): SQL injection vulnerabilities in Video Station. If a remote attacker compromises a user account, they can use these vulnerabilities to execute unauthorized code or commands. QNAP fixed both vulnerabilities in version 5.8.8.

CVE-2026-44084 (CVSS 8.7): Authorization bypass vulnerability via a user-controlled key. A remote attacker can use this vulnerability to access sensitive data.

CVE-2026-34015 (CVSS 8.7): Path traversal vulnerability. An attacker who compromises a user account can read the contents of unexpected files or system data.

CVE-2025-66272 and CVE-2025-66275 (CVSS 7.7): Two more path traversal-type vulnerabilities. These were fixed in 5.8.5 and later, but older installations are still at risk.

Who is affected

All QNAP NAS owners who have Video Station installed and whose app version is below 5.8.8 are affected. The app is installed from App Center on QTS and QuTS hero operating systems and is a popular tool for people setting up a movie and TV library on home and small-office NAS devices. If you have never installed Video Station, these vulnerabilities don’t affect you.

How to update

QNAP’s recommended path is short. Sign in to the QTS or QuTS hero interface with an administrator account, open App Center, type “Video Station” in the search box, and click the Update button next to the app in the results. If the Update button is not visible, the app is already on the latest version. If automatic updates are disabled in App Center settings, turning them on lets you receive patches in the future without waiting for announcements like this.

Is there active exploitation?

These vulnerabilities are not listed in CISA’s Known Exploited Vulnerabilities (KEV) list, and NVD records have not associated them with ransomware campaigns. So, for now, there is no data that would let us say “you are under attack.” Even so, NAS devices are among the most targeted devices by ransomware attackers because of internet-exposed ports and weak passwords. If you have not exposed Video Station directly to the internet, have limited remote access with a VPN or myQNAPcloud, and use a strong password and two-step verification for the administrator account, you have greatly reduced the risk.

In short, if Video Station is installed on your QNAP NAS, check the version in App Center and update to 5.8.8 or later. If the same screen shows pending updates for QTS and QuTS hero, don’t neglect those either.

Source: QNAP Security Advisories · CISA KEV · NVD