CVE-2026-22901: QuNetSwitch
Published Mar 20, 2026
·Updated
A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands.
We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later
Affected Software
2 affected components
QuNetSwitch QuNetSwitch<2.0.5.0906
QNAP QuNetSwitch>=2.0.1.13077<=2.0.5.0906
Remediation
Information
We have already fixed the vulnerability in the following version:
QuNetSwitch 2.0.5.0906 and later
Event History
Mar 20, 2026
CVE Published
via MITRE·04:21 PM
Data Sourced
via MITRE·04:21 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-22901?
CVE-2026-22901 has been classified as a critical severity command injection vulnerability.
2
How do I fix CVE-2026-22901?
To mitigate CVE-2026-22901, you should update QuNetSwitch to version 2.0.5.0906 or later.
3
What types of attacks can be executed via CVE-2026-22901?
Exploiting CVE-2026-22901 allows attackers to execute arbitrary commands on the system.
4
What versions of QuNetSwitch are affected by CVE-2026-22901?
CVE-2026-22901 affects versions of QuNetSwitch prior to 2.0.5.0906.
5
Can CVE-2026-22901 be exploited without a user account?
No, an attacker must first gain a user account to exploit CVE-2026-22901.