CVE-2026-22901 is a critical command injection flaw (CVSS 9.8) in QNAP QuNetSwitch. According to the record, a remote attacker who already holds a user account can run arbitrary commands. QNAP fixed it in QuNetSwitch 2.0.5.0906 and later, so update to that build.
What's affected
QuNetSwitch builds earlier than 2.0.5.0906 are affected for this CVE. The fix is in 2.0.5.0906 and later.
This is the second command injection in the advisory. CVE-2026-22897 was fixed earlier, in 2.0.4.0415. Anyone on an older build than 2.0.5.0906 is missing at least one of the QuNetSwitch fixes.
How to check if you're exposed
Open the app in QNAP App Center or its own interface and read the installed version. Compare it with the fixed version above. The advisory page is the authority for the exact upgrade path on your device model.
Also check whether the NAS or switch management interface is reachable from the internet. Management ports should sit behind a VPN or a firewall rule that allows only your admin networks.
What to do now
- Update QuNetSwitch to 2.0.5.0906 or later.
- Review user accounts on the device and remove those you do not need.
- Use strong, unique passwords and keep the management interface off the internet.
- Review logs for commands or settings changes you did not make.
Why it matters
The class is CWE-78 (OS Command Injection). User supplied data reaches an operating system command without being neutralized, so an attacker can attach extra instructions.
The advisory wording says the attacker needs a user account, but the CVSS vector records no privilege requirement, so the numeric score is the same 9.8. Do not read the account requirement as comfort. Accounts leak, get reused, or can be obtained through the sibling hard coded credentials flaw, CVE-2026-22900, on builds that have not been updated. The record does not mark this CVE as exploited in the wild.
Quick check
Why does it score 9.8 if an account is needed?
The vector in the record lists no privileges required, so the score does not reflect the account condition in the text.
How are the two QuNetSwitch command injections different?
The first needs no account and is fixed in 2.0.4.0415. This one needs an account and is fixed in 2.0.5.0906.
Sources
Last reviewed: 19 October 2026.
