CVE-2026-22899: QNAP File Station 6 NULL Pointer Dereference DoS Vulnerability

Technical summary

CVE-2026-22899 is a NULL pointer dereference (CWE-476) triggered via a network vector that requires prior authentication (PR:L). The vulnerability resides in QNAP File Station 6 and allows an authenticated remote attacker to cause the application to dereference a null pointer, resulting in service termination. The CVSS 3.1 score of 6.5 (MEDIUM severity) reflects a high availability impact (A:H) with no confidentiality or integrity consequences. The low attack complexity (AC:L) and network accessibility (AV:N) indicate the flaw can be reliably triggered by any authenticated user without special preconditions.

Business impact

Exploitation results in service unavailability for File Station, disrupting legitimate users' access to file storage and management capabilities. For organizations relying on QNAP File Station as a primary data repository or collaboration tool, repeated DoS attacks could materially impact productivity and business operations. However, because the attack requires valid user credentials and does not enable data theft or modification, the blast radius is confined to availability. The risk is moderate for environments where File Station uptime is business-critical and user account compromise is plausible.

Affected systems

QNAP File Station 6 is confirmed vulnerable. File Station 5 versions prior to 5.5.6.5208 were also affected but are now patched. Organizations running File Station 6 should assume their installations are at risk. The vulnerability does not affect File Station versions beyond 6 unless explicitly stated by QNAP in updated advisories; however, patch status for File Station 6 remains pending as of this writing.

Exploitability

Exploitability is moderate. While the flaw is network-accessible and can be reliably triggered, the attacker must first possess valid user credentials. In environments with weak password policies, oversharing of accounts, or compromised user credentials from unrelated incidents, the likelihood of exploitation increases significantly. No known public exploits or active exploitation has been reported in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting the vulnerability is not yet widely weaponized. However, the simplicity of a NULL pointer dereference suggests proof-of-concept development would not be technically challenging.

Remediation

Organizations should immediately check QNAP's security advisory portal for an available patch for File Station 6 and deploy it upon release. In the interim, apply the following mitigations: (1) Restrict File Station access to trusted networks only via firewall rules; (2) enforce strong authentication (multi-factor authentication if supported by your QNAP environment) to reduce unauthorized account access; (3) monitor File Station service logs for unexpected restarts or errors that may indicate exploitation attempts; (4) consider segmenting File Station from critical production systems. For File Station 5 deployments, upgrade to version 5.5.6.5208 or later immediately.

Patch guidance

QNAP has released File Station 5 version 5.5.6.5208 and later to address this vulnerability. File Station 6 users must monitor QNAP security advisories and their administrative console for patch availability. Verify the patched build number against QNAP's official release notes before deployment. Test patches in a non-production environment first. After patching, verify service functionality and confirm no regressions in file access or sharing workflows. Schedule patching during a maintenance window to minimize disruption if service restart is required.

Detection guidance

Monitor for sudden File Station service crashes or restarts without administrative action. Enable detailed logging on File Station (if available in your QNAP firmware version) and look for errors preceding crashes. Correlate File Station downtime with user authentication logs to identify if specific accounts or patterns precede incidents. Network-based detection is challenging since the flaw is triggered post-authentication; however, intrusion detection systems may flag unusual POST requests or API calls to File Station endpoints if behavioral baselines are established. Implement service health monitoring to alert on unexpected availability loss.

Why prioritize this

Although CVSS 6.5 (MEDIUM) and the lack of KEV status might suggest lower urgency, File Station 6's patch status is unclear, and authenticated attacks are common in environments where user credentials have been compromised or mismanaged. For organizations where File Station availability directly supports revenue-generating or critical operations, this vulnerability should be prioritized above the base CVSS score. Prioritize if: (1) File Station is externally accessible; (2) user account compromise is realistic in your threat model; (3) service downtime carries substantial business cost. Otherwise, schedule remediation within standard patch cycles.

Risk score, explained

CVSS 3.1 score of 6.5 reflects high availability impact balanced against the requirement for authenticated access. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network reachability and low attack complexity, but the PR:L (low privilege requirement) and absence of confidentiality/integrity impact cap the severity at MEDIUM. In an organization where user credentials are well-protected and File Station is internal-only, effective risk may be lower. In environments with weak credential hygiene or external File Station exposure, effective risk may exceed the base score.

Frequently asked questions