Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

HybridDesk Station lets attackers run commands

CVE-2026-47786 · published today
Summary

HybridDesk Station can be tricked into running any command an attacker sends, giving them control over the system. This risk is removed in version 4.2.23, 4.3.4 and later, so update your HybridDesk Station to one of these releases as soon as possible.

What to do
  • Update qnap systems inc. hybriddesk station to version 4.2.23 or later.
Affected software
VendorProductAffected versions
qnap systems inc. hybriddesk station < 4.2.23
Original advisory text
Pre-Authentication Command Injection
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.23 and later
HybridDesk Station 4.3.4 and later
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-47786 · NVD
CVE-2026-47786 · MITRE
Track software like this
Free during beta