All vulnerabilities
CVE-2026-39991

Stored Cross-Site Scripting (XSS) in Note Station file upload functionality

QNAP Systems Inc. Notes Station 3
Open in ThreatlineRecord JSON
CVSS
4.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.9.12Fixed versionCVE List
Published15 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code.

We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later

Text from CVE List

Affected versions 1

  • Notes Station 3affected: 3.9.x before 3.9.12CVE List

References 1