Firewalls, VPNs and routers

QNAP security incident history

Updated Oct 26, 2026. Data gathered daily from official public sources.

As of Oct 26, 2026, Vendor History found 11 actively exploited security flaws for QNAP, dated Mar 31, 2022 to Dec 21, 2023. Sources checked: the California and Washington Attorney General breach lists and CISA's Known Exploited Vulnerabilities catalog.

Breach notices and SEC cyber filings

None found in the sources we check.

Got a breach letter from QNAP? What to do when a vendor has a data breach.

Actively exploited security flaws

Flaws in QNAP products that CISA lists as exploited by attackers. If you use an affected product, check that it's updated. What a listing means.

1. Dec 21, 2023Exploited flaw

   QNAP VioStor NVR OS Command Injection Vulnerability (CVE-2023-47565). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

2. Sep 8, 2022Exploited flaw

   QNAP Photo Station Externally Controlled Reference Vulnerability (CVE-2022-27593). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

3. Jun 8, 2022Exploited flaw

   QNAP Photo Station Improper Access Control Vulnerability (CVE-2019-7192). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

4. Jun 8, 2022Exploited flaw

   QNAP QTS Improper Input Validation Vulnerability (CVE-2019-7193). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

5. Jun 8, 2022Exploited flaw

   QNAP Photo Station Path Traversal Vulnerability (CVE-2019-7194). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

6. Jun 8, 2022Exploited flaw

   QNAP Photo Station Path Traversal Vulnerability (CVE-2019-7195). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

7. May 24, 2022Exploited flaw

   QNAP NAS File Station Cross-Site Scripting Vulnerability (CVE-2018-19943). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

8. May 24, 2022Exploited flaw

   QNAP NAS File Station Command Injection Vulnerability (CVE-2018-19949). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

9. May 24, 2022Exploited flaw

   QNAP NAS File Station Cross-Site Scripting Vulnerability (CVE-2018-19953). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

10. Apr 11, 2022Exploited flaw

    QNAP Network-Attached Storage (NAS) Command Injection Vulnerability (CVE-2020-2509). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

11. Mar 31, 2022Exploited flaw

    QNAP NAS Improper Authorization Vulnerability (CVE-2021-28799). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

We check: California and Washington Attorney General breach notices, SEC cyber incident filings (Form 8-K, Item 1.05) and CISA's catalog of actively exploited security flaws. An empty section means we found nothing in those sources. It does not mean nothing happened. How it works

To cite: Vendor History, "QNAP security incident history," vendorhistory.com/vendor/qnap, data checked Oct 26, 2026. Free to reuse under CC BY 4.0 with credit to Vendor History.