CVE-2026-34008: **Privilege Escalation** World-writable crontab path monitored and executed by root-owned process
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker who has gained a user account on the affected system can exploit the vulnerability. The provided information does not indicate that unauthenticated remote attackers can use it directly.
Which versions are affected?
Notes Station 3 versions earlier than 3.9.11 are affected. The vulnerability is fixed in Notes Station 3 3.9.11 and later.
What is the recommended remediation?
Update QNAP Notes Station 3 to version 3.9.11 or later. This is the remediation identified in the provided information.