PT-2026-26639 · Qnap Systems · Qvr Pro

Fuzzinglabs · Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-22898

NVD

CVSS v4.0

9.3

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to gain access to the system.

We have already fixed the vulnerability in the following version: QVR Pro 2.7.4.14 and later

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-22898

Affected Products

Qvr Pro

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-22898 · Security Note
• https://twitter.com/0dayPublishing/status/2035033421911564462 · Twitter Post
• https://qnap.com/en/security-advisory/qsa-26-07 · Note