How many QNAP QuTS hero CVEs are in CISA KEV?

Yes — 2 of QNAP QuTS hero's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of QNAP QuTS hero are affected?

302 distinct QNAP QuTS hero versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in QNAP QuTS hero CVEs?

QNAP QuTS hero's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-121 (Stack-based Buffer Overflow), CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')).

How many critical QNAP QuTS hero vulnerabilities are there?

QNAP QuTS hero has 15 critical and 93 high-severity CVEs.

What is the average severity of QNAP QuTS hero CVEs?

The average CVSS base score across QNAP QuTS hero's scored CVEs is 6.0.

QNAP QuTS hero Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: QNAP QuTS hero vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

QNAP QuTS hero Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

QNAP QuTS hero has 253 published CVE records since 2020, of which 2 are in CISA's Known Exploited Vulnerabilities catalog and 6 have a known public exploit. The average CVSS base score across scored CVEs is 6.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting QNAP QuTS hero, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include build 20201031, build 20201119.

Severity and exploitation

How the CVSS severity of QNAP QuTS hero's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical15

High93

Medium102

Low43

In CISA’s Known Exploited Vulnerabilities catalog

2 of QNAP QuTS hero's CVEs are confirmed exploited in the wild.

Public exploits

6 of QNAP QuTS hero's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every QNAP QuTS hero version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

h4.5.x1 CVE
h5.0.x1 CVE

Version ranges

h5.2.0.2737 <= v <= h5.2.0.2737108 CVEs
h5.2.0.2782 <= v <= h5.2.0.2782106 CVEs
h5.2.0.2789 <= v <= h5.2.0.2789106 CVEs
h5.2.0.2802 <= v <= h5.2.0.2802105 CVEs
h5.2.0.2823 <= v <= h5.2.0.2823105 CVEs
h5.2.0.2851 <= v <= h5.2.0.2851105 CVEs
h5.2.0.2860 <= v <= h5.2.0.2860105 CVEs
h5.2.1.2929 <= v <= h5.2.1.292991 CVEs

Common weakness types

The CWE weakness categories most often found in QNAP QuTS hero CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many QNAP QuTS hero CVEs were published each year.

2020

2021

2022

2023

2024

100

2025

2026

Other QNAP products

Browse vulnerabilities for other products by QNAP.

QTS323 CVEs qutscloud77 CVEs Qsync Central63 CVEs File Station 555 CVEs file station54 CVEs Photo Station26 CVEs Video Station15 CVEs media streaming add-on13 CVEs

Frequently asked questions

Common questions about QNAP QuTS hero vulnerabilities.

How many CVEs does QNAP QuTS hero have?: QNAP QuTS hero has 253 published CVE records since 2020.
How many QNAP QuTS hero CVEs are in CISA KEV?: Yes — 2 of QNAP QuTS hero's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for QNAP QuTS hero vulnerabilities?: Yes — 6 of QNAP QuTS hero's CVEs have a known public exploit.
Which versions of QNAP QuTS hero are affected?: 302 distinct QNAP QuTS hero versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in QNAP QuTS hero CVEs?: QNAP QuTS hero's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-121 (Stack-based Buffer Overflow), CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')).
How many critical QNAP QuTS hero vulnerabilities are there?: QNAP QuTS hero has 15 critical and 93 high-severity CVEs.
What is the average severity of QNAP QuTS hero CVEs?: The average CVSS base score across QNAP QuTS hero's scored CVEs is 6.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track QNAP QuTS hero vulnerabilities

Monitor new QNAP QuTS hero vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

Fixed in

h5.2.6.3195 build 2025071526 CVEs
h5.2.7.3256 build 2025091317 CVEs
h5.2.1.2929 build 2024102516 CVEs
h5.3.1.3250 build 2025091215 CVEs
h5.1.4.2596 build 2023112814 CVEs
h4.5.4.2626 build 2023122513 CVEs
h5.1.3.2578 build 2023111013 CVEs
h5.1.2.2534 build 2023092710 CVEs
h5.2.5.3138 build 2025051910 CVEs
h5.3.4.3500 build 2026052010 CVEs
h5.1.5.2647 build 202401189 CVEs
h5.1.6.2734 build 202404149 CVEs
h5.1.9.2954 build 202411209 CVEs
h4.5.4.17718 CVEs
h5.0.1.2515 build 202309078 CVEs
h5.1.0.24248 CVEs
h5.1.0.2424 build 202306098 CVEs
h5.2.2.2952 build 202411168 CVEs
h5.2.9.3410 build 202602148 CVEs
h5.3.4.35008 CVEs
h4.5.4.26267 CVEs
h5.1.3.25787 CVEs
h5.2.3.3006 build 202501087 CVEs
h4.5.4.24766 CVEs
h4.5.4.2476 build 202307286 CVEs
h5.1.7.2770 build 202405206 CVEs
h5.2.9.34106 CVEs
h6.0.0.3397 build 202602066 CVEs
h5.0.1.25155 CVEs
h5.1.8.2823 build 202407125 CVEs
h5.2.8.3321 build 202511175 CVEs
h5.3.2.3354 build 202512255 CVEs
h4.5.1.14724 CVEs
h4.5.4.1771 build 202108254 CVEs
h4.5.4.2374 build 202304174 CVEs
h4.5.x4 CVEs
h5.0.0.19864 CVEs
h5.1.7.27704 CVEs
h5.2.7.3297 build 202510244 CVEs
h5.2.9.3499 build 202605144 CVEs
h5.3.1.3292 build 202510244 CVEs
h6.0.0.33974 CVEs
h6.0.0.34594 CVEs
h6.0.0.3459 build 202604094 CVEs
4.5.1.14723 CVEs
h4.5.2.16383 CVEs
h5.0.0.1986 build 202203243 CVEs
h5.0.1.23483 CVEs
h5.0.1.2348 build 202303243 CVEs
h5.0.1.2376 build 202304213 CVEs
h5.2.9.34993 CVEs
h5.3.0.3192 build 202507163 CVEs
h4.5.12 CVEs
h4.5.1.1582 build 202102172 CVEs
h4.5.2.1638 Build 202104142 CVEs
h4.5.4.1951 build 202202182 CVEs
h4.5.4.1971 build 202203102 CVEs
h4.5.4.23742 CVEs
h5.0.0.1949 build 202202152 CVEs
h5.0.x2 CVEs
h5.1.5.26472 CVEs
h5.1.8.28232 CVEs
h5.2.0.2782 build 202406012 CVEs
h5.2.4.3079 build 202503212 CVEs
5.1.3.2578_build 202311101 CVE
5.1.4.2596_build 202311281 CVE
h4.5.1.1472 build 202010311 CVE
h4.5.1.14911 CVE
h4.5.1.1491 build 202011191 CVE
h4.5.1.15821 CVE
h4.5.2.1638 build 202104141 CVE
h4.5.31 CVE
h4.5.4.2626_build 202312251 CVE
h4.5.4.2626_build_202312251 CVE
h4.5.4.2790 build 202406061 CVE
h4.5.4.2956 build 202411191 CVE
h4.x1 CVE
h5.0.0.19491 CVE
h5.0.1.22481 CVE
h5.0.1.2248 build 202212151 CVE
h5.0.1.22771 CVE
h5.0.1.2277 build 202301121 CVE
h5.0.1.23761 CVE
h5.1.0.2453 build 202307081 CVE
h5.1.1.24881 CVE
h5.1.1.2488 build 202308121 CVE
h5.1.4.25961 CVE
h5.1.6.2734_build_202404141 CVE
h5.1.x1 CVE
h5.2.0.27821 CVE
h5.2.0.2802 build 202406201 CVE
h5.2.0.28511 CVE
h5.2.8.3350 build 202512161 CVE
h5.2.x1 CVE
h5.x1 CVE
h6.0.0.3500 build 202605201 CVE
QuTS hero h5.2.0.2851 build 202408081 CVE
QuTS hero h5.2.5.3138 build 202505191 CVE

Find a version

253 CVEs

Sort

QTS, QuTS hero
CVE-2026-24719
Patch
CWE-78
Medium · CVSS 6.1
EPSS 1.0% (60th pct)2026-06-10
QTS, QuTS hero
CVE-2026-24717
Patch
CWE-22
Low · CVSS 1.2
EPSS 0.4% (32th pct)2026-06-10
QTS, QuTS hero
CVE-2026-24716
Patch
CWE-476
Low · CVSS 1.2
EPSS 0.3% (26th pct)2026-06-10
QTS, QuTS hero
CVE-2026-22893
Patch
CWE-78
High · CVSS 8.6
EPSS 1.1% (63th pct)2026-06-10
QTS, QuTS hero
CVE-2025-66281
Patch
CWE-476
Medium · CVSS 6.9
EPSS 0.5% (38th pct)2026-06-10
QTS, QuTS hero
CVE-2025-66280
Patch
CWE-121
Medium · CVSS 5.1
EPSS 0.4% (36th pct)2026-06-10
QTS, QuTS hero
CVE-2025-66279
Patch
CWE-78
High · CVSS 8.6
EPSS 1.1% (62th pct)2026-06-10
QTS, QuTS hero
CVE-2025-66273
Patch
CWE-78
High · CVSS 8.6
EPSS 1.1% (62th pct)2026-06-10
QuTS hero
CVE-2025-62850
Patch
CWE-476
Medium · CVSS 5.1
EPSS 0.3% (26th pct)2026-06-10
QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)
CVE-2025-59382
Patch
CWE-472
Low · CVSS 1.2
EPSS 0.4% (30th pct)2026-06-10
QTS
CVE-2025-66276
Patch
Critical · CVSS 9.2
EPSS 0.3% (21th pct)2026-06-10
QTS, QuTS hero
CVE-2025-62858
Patch
CWE-121
Medium · CVSS 5.1
EPSS 0.4% (37th pct)2026-06-09
QTS, QuTS hero
CVE-2026-41539
Patch
CWE-79
Medium · CVSS 6.3
EPSS 0.2% (9th pct)2026-06-09
QTS, QuTS hero
CVE-2024-14026
Patch
CWE-78
Low · CVSS 2.0
EPSS 0.6% (48th pct)2026-03-11
QTS, QuTS hero
CVE-2025-47205
Patch
CWE-476
Medium · CVSS 5.1
EPSS 0.4% (34th pct)2026-02-11
QuTS hero
CVE-2025-48725
Patch
CWE-121
Low · CVSS 0.6
EPSS 0.4% (33th pct)2026-02-11
QTS, QuTS hero
CVE-2025-58466
Patch
CWE-457
Low · CVSS 1.2
EPSS 0.5% (41th pct)2026-02-11
QuTS hero
CVE-2025-59386
Patch
CWE-476
Low · CVSS 1.2
EPSS 0.4% (30th pct)2026-02-11
QTS, QuTS hero
CVE-2025-66274
Patch
CWE-476
Medium · CVSS 5.1
EPSS 0.4% (30th pct)2026-02-11
QTS, QuTS hero
CVE-2025-66277
Patch
CWE-59
Critical · CVSS 9.2
EPSS 0.6% (48th pct)2026-02-11
QTS, QuTS hero
CVE-2025-62852
Patch
CWE-121
Low · CVSS 1.2
EPSS 0.4% (28th pct)2026-01-02
QTS, QuTS hero
CVE-2025-59381
Patch
CWE-22
Medium · CVSS 6.9
EPSS 0.5% (38th pct)2026-01-02
QTS, QuTS hero
CVE-2025-59380
Patch
CWE-22
Medium · CVSS 4.6
EPSS 0.6% (46th pct)2026-01-02
QTS, QuTS hero
CVE-2025-48721
Patch
CWE-121
Low · CVSS 1.2
EPSS 0.4% (36th pct)2026-01-02
QTS, QuTS hero
CVE-2025-9110
Patch
CWE-497
Low · CVSS 2.7
EPSS 0.5% (38th pct)2026-01-02
QTS, QuTS hero
CVE-2025-57705
Patch
CWE-770
Medium · CVSS 4.6
EPSS 0.3% (28th pct)2026-01-02
QTS, QuTS hero
CVE-2025-54166
Patch
CWE-125
Medium · CVSS 4.6
EPSS 0.3% (26th pct)2026-01-02
QTS, QuTS hero
CVE-2025-54165
Patch
CWE-125
Medium · CVSS 4.6
EPSS 0.3% (26th pct)2026-01-02
QTS, QuTS hero
CVE-2025-54164
Patch
CWE-125
Medium · CVSS 4.6
EPSS 0.3% (26th pct)2026-01-02
QTS, QuTS hero
CVE-2025-53596
Patch
CWE-476
Low · CVSS 1.2
EPSS 0.3% (28th pct)2026-01-02

Showing 30 of 253