CVE-2025-66276 is a critical flaw (CVSS 9.8) in QNAP QTS, reachable over the network without credentials. QNAP says it is fixed in QTS 5.2.7.3256 build 20250913 and later. QuTS hero is not affected. Update affected NAS devices and keep them off the public internet.
What's affected
- QNAP QTS, the operating system on many QNAP NAS models.
- Fixed in QTS 5.2.7.3256 build 20250913 and later.
- QuTS hero is not affected, per QNAP.
How to check if you're exposed
In the QTS web interface, open Control Panel, then System, then Firmware Update, and read the installed version. Compare it with 5.2.7.3256 build 20250913.
The record does not say which QTS release lines other than 5.2 carry the flaw, and it does not describe the weakness. Read QNAP advisory QSA-25-56 for the full list of affected releases before you decide a device is clear.
What to do now
- Find every QNAP NAS and note whether it runs QTS or QuTS hero.
- Update QTS devices to 5.2.7.3256 build 20250913 or later, or to the newest release available for your model.
- Check that no NAS management or file services are exposed directly to the internet. Use a VPN for remote access.
- Read QSA-25-56 for any extra steps QNAP lists.
- Confirm the version after the update, since a failed update can leave the old firmware running.
One more habit helps with NAS fleets. Keep a short table of device, model, operating system, build and exposure, and update it each time QNAP publishes an advisory. Teams that have this table can answer in minutes whether a new advisory touches them. Teams that do not end up logging in to each box by hand.
Why it matters
The CVE record gives a score and vector but no weakness class and no technical description, so this post does not guess at the cause. The vector says network reachable, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
That combination is why a NAS should never face the internet directly. These boxes hold backups and shared files, and a flaw in the operating system exposes all of it. The record does not list this CVE as exploited in the wild.
Quick check
Is QuTS hero affected by CVE-2025-66276?
No. QNAP states QuTS hero is not affected. The fix is in QTS 5.2.7.3256 build 20250913 and later.
Sources
Last reviewed: 19 October 2026.
