CVE-2026-53882
8.7HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-59
Impact
Authenticated remote users can exploit insecure link resolution to compromise the host system. The attacker needs valid user credentials on the device first.
Root cause
The application unsafely resolves symbolic or hard links before accessing files (CWE-59).
Affected systems
QNAP Virtualization Station versions prior to 4.1.1.130.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Virtualization Station to version 4.1.1.130 or later via the QTS App Center. If you cannot patch immediately, disable the Virtualization Station app or restrict authenticated user access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later