Is CVE-2024-14026 actively exploited?

No active exploitation of CVE-2024-14026 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-14026 be exploited remotely?

No. CVE-2024-14026 requires local access to exploit.

What is the CVSS score of CVE-2024-14026?

CVE-2024-14026 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2024-14026

HIGH

CVE-2024-14026

CWE-78Published: March 11, 2026· Updated: Mar 12, 2026

7.8

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.7th

Official Description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions:

QTS 5.1.9.2954 build 20241120 and later

QTS 5.2.3.3006 build 20250108 and later

QuTS hero h5.1.9.2954 build 20241120 and later

QuTS hero h5.2.3.3006 build 20250108 and later

NVD Source

Technical Analysis

CVE-2024-14026 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.