All vulnerabilities
CVE-2026-34007

Notes Station 3: **RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()`

QNAP Systems Inc. Notes Station 3
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.64%Chance of exploitation activity in the next 30 days, higher than 76% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.9.11Fixed versionCVE List
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

Text from CVE List

Affected versions 1

  • Notes Station 3affected: 3.9.x before 3.9.11CVE List

References 1