CVE-2026-26240 is a critical stack based buffer overflow (CVSS 9.1) in QNAP File Station 5. A remote, unauthenticated attacker can modify memory or crash processes. QNAP fixed it in File Station 5 version 5.5.6.5243 and later, so update the app and limit who can reach the NAS.
What's affected
QNAP's record says the flaw affects File Station 5, and that it is fixed in File Station 5 5.5.6.5243 and later. The record does not list the older versions one by one, so treat any File Station 5 build below 5.5.6.5243 as affected.
QNAP published one advisory, QSA-26-10, that covers this CVE and CVE-2026-26241, which has the same description and the same fix. Update once and both are closed.
How to check if you're exposed
On the QNAP device, open App Center, find File Station 5 in your installed apps and read its version number. If it is lower than 5.5.6.5243, you are exposed.
If you manage several devices, record the File Station version for each one in your asset list so the next advisory takes minutes instead of days.
Also check whether the NAS web interface is reachable from outside. A device with port forwarding or a public address is a far bigger risk than one that only answers on a management network.
What to do now
- Open App Center on each QNAP device and update File Station 5 to 5.5.6.5243 or later.
- Confirm the version after the update by reading it in App Center again.
- Remove port forwarding for the NAS administration and file services. If remote access is needed, use a VPN.
- Read QNAP's advisory QSA-26-10 for any additional steps for your model and firmware.
- Add the device to your regular patch review, since NAS appliances often sit outside normal server patching.
Why it matters
The weakness is CWE-121, a stack based buffer overflow. The program writes more data into a fixed size memory area on the stack than it can hold, and the extra bytes overwrite neighbouring memory. QNAP says an attacker can use that to modify memory or crash processes.
The CVSS vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, shows why the score is 9.1: network reachable, low complexity, no login and no user action. It rates impact on confidentiality as none, but high on integrity and availability. The record is not on the CISA Known Exploited Vulnerabilities list.
NAS devices hold shared files and backups, which makes them a valuable target even when a given bug only crashes a process.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does one update fix both CVE-2026-26240 and CVE-2026-26241?
Yes. QNAP lists the same fixed version, File Station 5 5.5.6.5243 and later, for both records in advisory QSA-26-10.
Is this exploited in the wild?
The record's KEV flag is false. QNAP's text does not say it is being exploited.
Sources
- QNAP security advisory QSA-26-10 (cited by the record; the page loads its content with scripts, so the fixed version above is taken from the NVD record text)
- NVD record for CVE-2026-26240
Last reviewed: 19 October 2026.
