CVE-2026-47786: Pre-Authentication Command Injection

Q: Which HybridDesk Station versions contain the fix?

The issue is fixed in HybridDesk Station 4.2.23 and later, and in HybridDesk Station 4.3.4 and later.

Q: What level of access does an attacker need?

The vulnerability is pre-authentication, so an attacker does not need to authenticate before attempting exploitation. Successful exploitation could allow a remote attacker to execute arbitrary operating-system commands.

Published Oct 15, 2026

Updated

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later

Affected Software

1 affected component

QNAP Hybriddesk Station<4.2.23, <4.3.4

Event History

Oct 15, 2026

CVE Published

via MITRE·09:38 AM

Data Sourced

via MITRE·09:38 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Which HybridDesk Station versions contain the fix?

The issue is fixed in HybridDesk Station 4.2.23 and later, and in HybridDesk Station 4.3.4 and later.

What level of access does an attacker need?

The vulnerability is pre-authentication, so an attacker does not need to authenticate before attempting exploitation. Successful exploitation could allow a remote attacker to execute arbitrary operating-system commands.