CVE-2026-22897 is a critical command injection flaw (CVSS 9.8) in QNAP QuNetSwitch. The record says remote attackers can execute arbitrary commands over the network without logging in. QNAP fixed it in QuNetSwitch 2.0.4.0415 and later, and the later 2.0.5.0906 build also covers two sibling CVEs.
What's affected
QuNetSwitch versions earlier than 2.0.4.0415 are affected, according to the fix statement in the record. QNAP has fixed it in 2.0.4.0415 and later.
QNAP published two more QuNetSwitch CVEs in the same advisory, CVE-2026-22900 (hard coded credentials) and CVE-2026-22901 (a second command injection). Those two are fixed in 2.0.5.0906. Moving to 2.0.5.0906 or later closes all three, so it is the simpler target.
How to check if you're exposed
Open the app in QNAP App Center or its own interface and read the installed version. Compare it with the fixed version above. The advisory page is the authority for the exact upgrade path on your device model.
Also check whether the NAS or switch management interface is reachable from the internet. Management ports should sit behind a VPN or a firewall rule that allows only your admin networks.
What to do now
- Update QuNetSwitch to 2.0.5.0906 or later, which includes the 2.0.4.0415 fix and the later ones.
- Remove internet exposure of the management interface.
- Review the device for accounts, scheduled tasks or settings you did not create.
- Subscribe to QNAP security advisories for the devices you run.
Why it matters
The weakness is CWE-78 (OS Command Injection). Input from the network reaches an operating system command without being neutralized, so crafted input can add its own commands. Because no account is needed, the CVSS vector scores network access, low complexity and full impact on confidentiality, integrity and availability.
Network appliances are attractive because they sit in privileged positions and are patched slowly. The record does not mark this CVE as exploited in the wild, but a 9.8 with no login requirement is the kind of flaw worth updating before anyone writes a tool for it.
Quick check
Which build should I install?
2.0.5.0906 or later, since it covers this CVE and the two related QuNetSwitch CVEs.
Is a login required?
The record says remote attackers can exploit it, with no privileges listed in the vector.
Sources
Last reviewed: 19 October 2026.
