CVE-2026-22898 is a critical flaw (CVSS 9.8) in QNAP QVR Pro, the video surveillance software. A critical function lacks authentication, so remote attackers can gain access to the system without credentials. QNAP fixed it in QVR Pro 2.7.4.14 and later, and the update is the primary action.
What's affected
QVR Pro versions earlier than 2.7.4.14 are affected, based on the record's fix statement. QVR Pro 2.7.4.14 and later contain the fix.
QVR Pro stores and serves camera footage, so a compromise reaches both the recordings and the cameras and network behind them.
How to check if you're exposed
Open QVR Pro in QNAP App Center or its own interface and read the installed version. Compare it with the fixed version above. The advisory page is the authority for the exact upgrade path on your device model.
Also check whether the NAS or switch management interface is reachable from the internet. Management ports should sit behind a VPN or a firewall rule that allows only your admin networks.
What to do now
- Update QVR Pro to 2.7.4.14 or later.
- Take the QVR Pro interface off the internet and require VPN access.
- Review user accounts and recent access logs for activity you cannot explain.
- Check that camera credentials stored in the system are changed if you suspect misuse.
Why it matters
The class is CWE-306 (Missing Authentication for Critical Function). A function that changes or exposes something important can be reached without proving who is calling. Authentication checks have to cover every route to a sensitive action, and one missed route is enough.
The score of 9.8 reflects network reach, no privileges and no user interaction. The record does not mark this CVE as a Known Exploited Vulnerability. Surveillance systems carry added privacy risk because the stored video can be sensitive, which is a good reason to treat the patch as time sensitive.
Quick check
What is the fixed version?
QVR Pro 2.7.4.14 and later.
Does a firewall help?
It reduces exposure, but the update is what removes the flaw.
Sources
Last reviewed: 19 October 2026.
