CVE-2026-24722: Null Pointer Dereference in File Station 5

Q: Who can exploit this vulnerability?

A remote attacker must first obtain a user account. The reported impact is a denial-of-service attack.

Q: Which versions are fixed?

The vulnerability is fixed in File Station 5 version 5.5.6.5243 and later.

Q: What should organizations do if they cannot update immediately?

Limit access to File Station 5 user accounts and review account access, since exploitation requires an attacker to gain a user account.

Published Oct 15, 2026

Updated

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

Affected Software

1 affected component

QNAP File Station 5<5.5.6.5243

Event History

Oct 15, 2026

CVE Published

via MITRE·06:59 AM

Data Sourced

via MITRE·06:59 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

A remote attacker must first obtain a user account. The reported impact is a denial-of-service attack.

Which versions are fixed?

The vulnerability is fixed in File Station 5 version 5.5.6.5243 and later.

What should organizations do if they cannot update immediately?

Limit access to File Station 5 user accounts and review account access, since exploitation requires an attacker to gain a user account.