CVE-2026-22900: Critical Hard Coded Credentials in QNAP QuNetSwitch

CVE-2026-22900 is a critical flaw (CVSS 9.8) in QNAP QuNetSwitch caused by hard coded credentials. Remote attackers can use them to gain unauthorized access. QNAP fixed it in QuNetSwitch 2.0.5.0906 and later, which also contains the earlier command injection fix, so update to that build.

What's affected

QuNetSwitch builds earlier than 2.0.5.0906 are affected for this CVE. The fixed build is 2.0.5.0906 and later.

Two other CVEs are part of the same QNAP advisory: CVE-2026-22897 and CVE-2026-22901, both command injection. One update addresses all three.

How to check if you're exposed

Open the app in QNAP App Center or its own interface and read the installed version. Compare it with the fixed version above. The advisory page is the authority for the exact upgrade path on your device model.

Also check whether the NAS or switch management interface is reachable from the internet. Management ports should sit behind a VPN or a firewall rule that allows only your admin networks.

What to do now

1. Update QuNetSwitch to 2.0.5.0906 or later.
2. Put the management interface behind a VPN and block it from the internet.
3. Review accounts on the device and rotate any passwords you set yourself.
4. Check logs for logins from addresses you do not recognize.

Why it matters

The weakness is CWE-798 (Use of Hard-coded Credentials). A password or key is written into the product, so every copy of the product shares it, and anyone who learns it can log in to any device that has not been updated.

You cannot fix this class by changing a password, because the secret lives in the code. Only a new build removes it. The record does not mark this CVE as exploited in the wild. Device makers should replace fixed credentials with per device values or force a change at first setup, and buyers can ask vendors how they handle that.

Quick check

Sources

• QNAP advisory QSA-26-11, as referenced by the NVD record

Last reviewed: 19 October 2026.