An OS command injection vulnerability has been reported to affect Notes Station 3.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 15, 2026 · NIST NVD

   Detected

   An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

Affected

• vendor QNAP Systems Inc. Notes Station 3version unspecified

Sources

• CIRCL Vulnerability LookupVulnerability recordCVE-2026-34007

  An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

  vulnerability.circl.lu
• CVE.orgVulnerability recordCVE-2026-34007

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-34007

  30-day exploitation probability 1.6%

  first.org
• NIST NVDVulnerability recordCVE-2026-34007

  An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

  nvd.nist.gov

References

• Reference · qnap.com