CVE-2026-22896: Stored XSS via Interface Name in Network & Virtual Switch App

Severity: medium (CVSS 6.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-15
Weakness: CWE-79

Description

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later

Affected products

QNAP Systems Inc. Network & Virtual Switch: from QTS 5.1.x before QTS 5.1.8.2823 build 20240712; from QTS 5.2.x before QTS 5.2.1.2930 build 20241025; from QuTS cloud c5.2.x before QuTS cloud c5.2.4.3041 build 20250211; from QuTS hero h5.1.x before QuTS hero h5.1.8.2823 build 20240712; from QuTS hero h5.2.x before QuTS hero h5.2.1.2929 build 20241025 — fixed in QTS 5.1.8.2823 build 20240712, QTS 5.2.1.2930 build 20241025, QuTS cloud c5.2.4.3041 build 20250211, QuTS hero h5.1.8.2823 build 20240712, QuTS hero h5.2.1.2929 build 20241025

How to fix

Upgrade to a fixed version: QNAP Systems Inc. Network & Virtual Switch QTS 5.1.8.2823 build 20240712, QTS 5.2.1.2930 build 20241025, QuTS cloud c5.2.4.3041 build 20250211, QuTS hero h5.1.8.2823 build 20240712. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-22896 or the next vulnerability affects your stack