Critical 9.8Known exploited (CISA KEV)Published Oct 28, 2020

CVE-2018-19949If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands.

Updated under an hour ago (2026-10-19 07:50 UTC)

Does this affect you?

It affects QNAP Systems Inc. QTS and 1 other product. Add what you run to find out whether that includes you.

CISA lists it as known exploited since May 24, 2022; federal agencies had to remediate by Jun 14, 2022, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for QNAP Systems Inc. QTS

Exploited in the last 30 days

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-20, CWE-77, CWE-78
Known exploited: Added to CISA KEV May 24, 2022; federal remediation due Jun 14, 2022; known ransomware useApply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 28.63% (percentile 98)
Assigned by: qnap
NVD analysis: Analyzed
Record last updated: Oct 2, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

QNAP Systems Inc. QTS qnap_systems:qts (from the name)	from unspecified before 4.4.2.1231	CNA record
qnap qts qnap:qts	before 4.2.6; from 4.3.1.0013 before 4.3.3.1161; from 4.3.4 before 4.3.4.1190; from 4.3.6 before 4.3.6.1218; from 4.4.0 before 4.4.1.1201; from 4.4.2 before 4.4.2.1231; 4.2.6; 4.2.6; and 4 more ranges	NVD

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-01x-refsource-misc, vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19949us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.