CVE-2026-39997: Unauthenticated Remote Input Injection in QNAP HD Station's remotepad

Q: Which HybridDesk Station versions are affected?

HybridDesk Station versions earlier than 4.2.22 are affected. The vulnerability is fixed in version 4.2.22 and later.

Q: What access does an attacker need to exploit this issue?

The issue is described as unauthenticated, so an attacker does not need to authenticate to exploit the affected critical function. Successful exploitation could allow a remote attacker to gain access to the system.

Q: How can I remediate the vulnerability?

Update HybridDesk Station to version 4.2.22 or later. No alternative mitigation is provided in the available information.

Published Oct 15, 2026

Updated

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.

We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later

Affected Software

1 affected component

QNAP Hybriddesk Station<4.2.22

Event History

Oct 15, 2026

CVE Published

via MITRE·09:38 AM

Data Sourced

via MITRE·09:38 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Which HybridDesk Station versions are affected?

HybridDesk Station versions earlier than 4.2.22 are affected. The vulnerability is fixed in version 4.2.22 and later.

What access does an attacker need to exploit this issue?

The issue is described as unauthenticated, so an attacker does not need to authenticate to exploit the affected critical function. Successful exploitation could allow a remote attacker to gain access to the system.

How can I remediate the vulnerability?

Update HybridDesk Station to version 4.2.22 or later. No alternative mitigation is provided in the available information.