QNAP HybridDesk Station: Missing authentication for critical function
Summary
HybridDesk Station, an optional add-on app for QNAP NAS devices, contains a missing authentication vulnerability (CWE-306) in a critical function. A remote attacker can gain access to the system without logging in, according to the CNA description. The issue applies only when the app is installed and the NAS is reachable by the attacker, and user interaction is listed as passive in the CVSS vector.
Affected
- HybridDesk Station 4.2.x prior to 4.2.22
- Unknown whether other branches are affected; a related CVE (CVE-2026-47786) reportedly affects 4.2.22 and 4.3.x releases up to 4.3.3
Fixed in
- HybridDesk Station 4.2.22 and later (per QNAP CNA record; to be verified against QNAP advisory)
- For the related CVE-2026-47786: 4.2.23 or 4.3.4 and later
Workaround
Unknown. No vendor-documented workaround is available. Interim measures: uninstall HybridDesk Station if not needed, restrict NAS management and HybridDesk access to the LAN or VPN, and make sure the NAS is not directly reachable from the internet.
Exploitation
- No evidence of exploitation in the wild found; CISA ADP lists exploitation as none
- Not listed in the CISA KEV catalog as of the research date (not verified on CISA's site)
- No public proof of concept known; EPSS 0.00242
Our recommendation
- Check whether HybridDesk Station is installed on each QNAP NAS.
- Check whether the NAS is reachable from the internet (port forwarding, cloud relay, VPN).
- Update HybridDesk Station to 4.2.23 or later (or 4.3.4 or later on the 4.3.x branch) to also cover CVE-2026-47786.
- If the app is not needed, uninstall it.
- Restrict access to NAS management interfaces to the LAN or VPN and monitor logs for unexpected access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- QNAP app release notes (HybridDesk Station) www.qnap.com
- VulDB CVE-2026-39997 vuldb.com
- OpenCVE CVE-2026-39997 app.opencve.io
- Vulners CVE-2026-39997 vulners.com
- Strix CVE-2026-39997 www.strix.ai
- Vulners CVE-2026-47786 (related CVE) vulners.com
- VulDB CVE-2026-47786 (related CVE) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:31.
Original description (NVD)
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.