CVE-2024-14026: QTS, QuTS hero

Q: What is the severity of CVE-2024-14026?

CVE-2024-14026 has been classified as a critical vulnerability due to its potential to allow unauthorized command execution.

Q: How can I fix CVE-2024-14026?

To fix CVE-2024-14026, upgrade to the latest version of QNAP QTS or QuTS hero that addresses this vulnerability.

Q: Who is affected by CVE-2024-14026?

CVE-2024-14026 affects users of QNAP QTS and QuTS hero versions up to 5.1.9.2954 and 5.2.3.3006.

Q: What can an attacker do with CVE-2024-14026?

An attacker with local network access can exploit CVE-2024-14026 to execute arbitrary commands on the affected systems.

Q: Is there a work-around for CVE-2024-14026?

There are currently no recommended work-arounds for CVE-2024-14026; patching the affected software is advised.

Published Mar 11, 2026

Updated

A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.3.3006 build 20250108 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.3.3006 build 20250108 and later

Affected Software

52 affected components

QNAP QTS<5.1.9.2954

QNAP QTS<5.2.3.3006

QNAP QuTS hero<h5.1.9.2954

QNAP QuTS hero<h5.2.3.3006

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QTS=5.1.3.2578-build_20231110

QNAP QTS=5.1.4.2596-build_20231128

QNAP QTS=5.1.5.2645-build_20240116

QNAP QTS=5.1.5.2679-build_20240219

QNAP QTS=5.1.6.2722-build_20240402

QNAP QTS=5.1.7.2770-build_20240520

QNAP QTS=5.1.8.2823-build_20240712

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QTS=5.2.2.2950-build_20241114

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

QNAP QuTS hero=h5.1.3.2578-build_20231110

QNAP QuTS hero=h5.1.4.2596-build_20231128

QNAP QuTS hero=h5.1.5.2647-build_20240118

QNAP QuTS hero=h5.1.5.2680-build_20240220

QNAP QuTS hero=h5.1.6.2734-build_20240414

QNAP QuTS hero=h5.1.7.2770-build_20240520

QNAP QuTS hero=h5.1.7.2788-build_20240607

QNAP QuTS hero=h5.1.7.2794-build_20240613

QNAP QuTS hero=h5.1.8.2823-build_20240712

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

QNAP QuTS hero=h5.2.2.2952-build_20241116

Remediation

Information

Event History

Mar 11, 2026

CVE Published

via MITRE·08:02 AM

Data Sourced

via MITRE·08:02 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-14026?

CVE-2024-14026 has been classified as a critical vulnerability due to its potential to allow unauthorized command execution.

How can I fix CVE-2024-14026?