CVE-2026-41539: QTS, QuTS hero

Q: What is the severity of CVE-2026-41539?

The severity of CVE-2026-41539 is rated high with a score of 8.7.

Q: How do I fix CVE-2026-41539?

To fix CVE-2026-41539, update to QTS version 5.2.9.3492 or later and QuTS hero version h5.2.9.3499 or later.

Q: What type of attack is CVE-2026-41539 associated with?

CVE-2026-41539 is associated with a cross-site scripting (XSS) attack.

Q: What is the impact of CVE-2026-41539?

The impact of CVE-2026-41539 allows remote attackers to bypass security mechanisms or read application data.

Q: Which versions of QNAP OS are affected by CVE-2026-41539?

CVE-2026-41539 affects several versions of QNAP QTS and QuTS hero prior to the specified fixed versions.

Published Jun 9, 2026

Updated

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3500 build 20260520 and later

Affected Software

58 affected components

QNAP QTS<5.2.9.3492

QNAP QuTS hero<h5.2.9.3499, <h5.3.4.3500, <h6.0.0.3500

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QTS=5.2.2.2950-build_20241114

QNAP QTS=5.2.3.3006-build_20250108

QNAP QTS=5.2.4.3070-build_20250312

QNAP QTS=5.2.4.3079-build_20250321

QNAP QTS=5.2.4.3092-build_20250403

QNAP QTS=5.2.5.3145-build_20250526

QNAP QTS=5.2.6.3195-build_20250715

QNAP QTS=5.2.6.3229-build_20250818

QNAP QTS=5.2.7.3256-build_20250913

QNAP QTS=5.2.7.3297-build_20251024

QNAP QTS=5.2.8.3332-build_20251128

QNAP QTS=5.2.8.3350-build_20251216

QNAP QTS=5.2.8.3359-build_20251225

QNAP QTS=5.2.9.3410-build_20260214

QNAP QTS=5.2.9.3451-build_20260327

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

QNAP QuTS hero=h5.2.2.2952-build_20241116

QNAP QuTS hero=h5.2.3.3006-build_20250108

QNAP QuTS hero=h5.2.4.3070-build_20250312

QNAP QuTS hero=h5.2.4.3079-build_20250321

QNAP QuTS hero=h5.2.5.3138-build_20250519

QNAP QuTS hero=h5.2.6.3195-build_20250715

QNAP QuTS hero=h5.2.7.3256-build_20250913

QNAP QuTS hero=h5.2.7.3297-build_20251024

QNAP QuTS hero=h5.2.8.3321-build_20251117

QNAP QuTS hero=h5.2.8.3350-build_20251216

QNAP QuTS hero=h5.2.8.3359-build_20251225

QNAP QuTS hero=h5.2.9.3410-build_20260214

QNAP QuTS hero=h5.2.9.3492-build_20260507

QNAP QuTS hero=h5.3.0.3115-build_20250430

QNAP QuTS hero=h5.3.0.3145-build_20250530

QNAP QuTS hero=h5.3.0.3192-build_20250716

QNAP QuTS hero=h5.3.1.3250-build_20250912

QNAP QuTS hero=h5.3.1.3292-build_20251024

QNAP QuTS hero=h5.3.2.3354-build_20251225

QNAP QuTS hero=h5.3.3.3424-build_20260305

QNAP QuTS hero=h6.0.0.3324-build_20251125

QNAP QuTS hero=h6.0.0.3382-build_20260122

QNAP QuTS hero=h6.0.0.3397-build_20260206

QNAP QuTS hero=h6.0.0.3459-build_20260409

Event History

Jun 9, 2026

CVE Published

via MITRE·05:51 AM

Data Sourced

via MITRE·05:51 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeaknessAffected Software

May 20, 58464

Event

via NVD·12:23 PM

Frequently Asked Questions

What is the severity of CVE-2026-41539?

The severity of CVE-2026-41539 is rated high with a score of 8.7.

How do I fix CVE-2026-41539?

To fix CVE-2026-41539, update to QTS version 5.2.9.3492 or later and QuTS hero version h5.2.9.3499 or later.

What type of attack is CVE-2026-41539 associated with?