QNAP Systems Inc Notes Station 3 vulnerabilities

4 CVEs affecting QNAP Systems Inc Notes Station 3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-39991, published 2026-10-15.

More from QNAP Systems Inc.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-34007, published 2026-10-15. Medium severity, CVSS 6.9. EPSS: 1.6% chance of exploitation in the next 30 days. An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed…
• CVE-2026-39991, published 2026-10-15. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious…
• CVE-2026-34009, published 2026-10-15. High severity, CVSS 8.4. EPSS: 0.1% chance of exploitation in the next 30 days. An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to…
• CVE-2026-34008, published 2026-10-15. High severity, CVSS 8.5. EPSS: 0.1% chance of exploitation in the next 30 days. An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability…