CVE-2026-26244 is a SQL injection vulnerability in Video Station, an app for QNAP NAS devices. The record scores it 8.8 (High). QNAP says a remote attacker who gains a user account can exploit it to execute unauthorized code or commands. QNAP has fixed it in Video Station 5.8.8 and later.
What's affected
QNAP's wording in the CVE record is that the issue is fixed in Video Station 5.8.8 and later, so earlier versions of the Video Station app are affected. Two near-identical SQL injection CVEs (CVE-2026-26244 and CVE-2026-26245) and an authorization bypass (CVE-2026-44084) were published together for the same app and share the same fixed version.
The QNAP release notes page we fetched did not render any entries, so we could not confirm the fix from the release notes themselves. The fixed version below comes from the vendor's wording in the CVE record. Open the QNAP security advisory for this CVE and the App Center before relying on it.
Weakness class: CWE-89, SQL injection. The record and QNAP agree on severity here, with 8.8 (High) and no conflicting score on the sources we could read.
How to check if you're exposed
Log in to QTS or QuTS hero, open App Center, and look at the installed Video Station version. Anything below 5.8.8 is affected. If Video Station is not installed, this flaw does not apply to that NAS.
Also check who has accounts on the NAS. The attack needs a valid user account, so review the user list, remove unused accounts, and check whether the NAS is reachable from the internet through port forwarding or QNAP's cloud access features. Exposure is much larger when a NAS with media apps is internet facing.
What to do now
- Open App Center on each QNAP NAS and update Video Station to 5.8.8 or later.
- If you do not use Video Station, uninstall it. Removing unused apps removes their bugs.
- Update CVE-2026-26245 in the same pass, since it was fixed in the same release.
- Remove unused user accounts and enforce strong passwords and two step verification on the NAS.
- Remove internet exposure of NAS admin and app ports where possible, and use a VPN for remote access.
Why it matters
SQL injection occurs when an application builds a database query from user input without keeping data and code apart, so input can change the query. The standard fix is parameterized queries. QNAP says the impact here is unauthorized code or command execution, which is the worst case for a storage device.
The account requirement lowers the risk from anonymous attackers, but NAS credentials leak often through reused passwords, and a media app is the kind of service that many family or team members get accounts for. Once someone has any account, the flaw turns a low privilege login into command execution on the device. The KEV flag is false and QNAP does not report exploitation. Backups on the NAS are an attractive target, so treat this update as a priority.
Quick check
Do I need to be logged in to exploit it?
Yes. QNAP says the attacker needs a user account first.
What is the fixed version?
QNAP says Video Station 5.8.8 and later. Confirm in the App Center and QNAP's advisory.
Sources
Last reviewed: 18 October 2026.
