{"id":"CVE-2026-22898","state":"PUBLISHED","title":"QVR Pro","description":"A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to gain access to the system.\n\nWe have already fixed the vulnerability in the following version:\nQVR Pro 2.7.4.14 and later","publishedAt":"2026-03-20T16:21:30.440Z","updatedAt":"2026-03-27T03:55:39.294Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"qnap"},"assigner":"qnap","products":["QNAP Systems Inc. QVR Pro"],"affected":[{"vendor":"QNAP Systems Inc.","product":"QVR Pro","defaultStatus":"unaffected","versions":[{"version":"2.7.x","status":"affected","lessThan":"2.7.4.14","versionType":"custom"}]}],"references":["https://www.qnap.com/en/security-advisory/qsa-26-07"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/22xxx/CVE-2026-22898.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-22898","state":"PUBLISHED","datePublished":"2026-03-20T16:21:30.440Z","dateUpdated":"2026-03-27T03:55:39.294Z","assignerShortName":"qnap","assignerOrgId":"2fd009eb-170a-4625-932b-17a53af1051f","dateReserved":"2026-01-13T07:49:08.784Z"},"containers":{"cna":{"title":"QVR Pro","descriptions":[{"lang":"en","value":"A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to gain access to the system.\n\nWe have already fixed the vulnerability in the following version:\nQVR Pro 2.7.4.14 and later"}],"affected":[{"vendor":"QNAP Systems Inc.","product":"QVR Pro","defaultStatus":"unaffected","versions":[{"version":"2.7.x","status":"affected","lessThan":"2.7.4.14","versionType":"custom"}]}],"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-26-07"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306","type":"CWE"}]}],"providerMetadata":{"shortName":"qnap","orgId":"2fd009eb-170a-4625-932b-17a53af1051f","dateUpdated":"2026-03-20T16:21:30.440Z"},"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115"}]}],"solutions":[{"lang":"en","value":"We have already fixed the vulnerability in the following version:\nQVR Pro 2.7.4.14 and later","supportingMedia":[{"type":"text/html","base64":false,"value":"We have already fixed the vulnerability in the following version:<br>QVR Pro 2.7.4.14 and later<br>"}]}],"credits":[{"lang":"en","value":"FuzzingLabs","type":"finder"}],"source":{"advisory":"QSA-26-07","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-26T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-22898"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-27T03:55:39.294Z"}}]}}}