CVE-2026-39997
Unauthenticated Remote Input Injection in QNAP HD Station's remotepad
QNAP Systems Inc. HybridDesk Station
CVSS
8.9HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.2.22HybridDesk StationCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.
We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later
Text from CVE List
Affected versions 1
- HybridDesk Stationaffected: 4.2.x before 4.2.22CVE List