CVE-2026-47786
9.3CriticalPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Remote, unauthenticated attackers can execute arbitrary OS commands over the network. They need network access to the HybridDesk Station service to exploit it.
Root cause
Improper neutralization of special elements in user-supplied input leads to OS command injection.
Affected systems
QNAP HybridDesk Station versions prior to 4.2.23 and versions prior to 4.3.4.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade HybridDesk Station to 4.2.23, 4.3.4, or later via the QNAP App Center; if you cannot patch immediately, disable or stop the HybridDesk Station application.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later