CVE-2026-39997

CVSS 8.9 (high) · published 2026-10-15

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later

Weakness: CWE-306

Source: NVD CVE-2026-39997

References

• https://www.qnap.com/en/app-release-notes?keyword=HybridDesk%20Station&app=HD_Station&product-line=nas

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.