CVE-2025-9110
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions.
Published Jan 2, 2026 · updated Oct 14, 2026 · qnap qts
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later QuTS hero h5.3.1.3250 build 20250912 and later
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jan 2, 2026 · NIST NVD
Detected
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later QuTS
Oct 14, 2026 · NIST NVD
Updated
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later QuTS
Affected
- cpe qnap/qts5.2.0.2737
- cpe qnap/qts5.2.0.2744
- cpe qnap/qts5.2.0.2782
- cpe qnap/qts5.2.0.2802
- cpe qnap/qts5.2.0.2823
- cpe qnap/qts5.2.0.2851
- cpe qnap/qts5.2.0.2860
- cpe qnap/qts5.2.1.2930
- cpe qnap/quts heroh5.2.0.2737
Sources
- CVE.orgVulnerability recordCVE-2025-9110
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-9110
30-day exploitation probability 0.5%
first.org - NIST NVDVulnerability recordCVE-2025-9110
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. We have already fixed the vulnerabili
nvd.nist.gov