PT-2026-26639 · Qnap · Qvr Pro

Fuzzinglabs · Published 2026-03-20 · Updated 2026-04-15 · CVE-2026-22898

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QVR Pro versions prior to 2.7.4.14

Description QVR Pro is affected by a missing authentication check for critical functions, allowing remote attackers to gain access to the system. The issue allows attackers to bypass authentication and access QVR Pro surveillance systems. The vulnerability has a CVSS score of 9.3, indicating a critical severity. It is described as a 'network-accessible goldmine for instant system compromise'. No information is available regarding the number of potentially affected devices or real-world exploitation incidents.

Recommendations Update QVR Pro to version 2.7.4.14 or later.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-22898

ZDI-26-292

Affected Products

Qvr Pro

References · 11

• https://qnap.com/en/security-advisory/qsa-26-07 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-292 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22898 · Security Note
• https://twitter.com/TheZDIBugs/status/2044537516628349234 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2035191254120898822 · Twitter Post
• https://twitter.com/f1tym1/status/2036143331835629706 · Twitter Post
• https://twitter.com/vuln_tracker/status/2035680699135717587 · Twitter Post
• https://twitter.com/threatcluster/status/2036108147727733130 · Twitter Post
• https://twitter.com/CVEnew/status/2035619798378516883 · Twitter Post
• https://twitter.com/infoflowcloud/status/2035621556601114912 · Twitter Post
• https://twitter.com/0dayPublishing/status/2035033421911564462 · Twitter Post