{"id":"CVE-2026-47786","published":"2026-10-15T10:17:14Z","modified":"2026-10-15T16:32:39Z","title":"An OS command injection vulnerability has been reported to affect HybridDesk Station","vendor":"QNAP Systems Inc.","product":"HybridDesk Station","tier":"core","eol":null,"description":{"text":"An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.\n\nWe have already fixed the vulnerability in the following version:\nHybridDesk Station 4.2.23 and later\nHybridDesk Station 4.3.4 and later","provenance":"source","from":"NVD"},"summary":{"text":"An OS command injection flaw in the QNAP HybridDesk Station product allows improper neutralization of special elements in commands run by the operating system. An attacker with network access can execute arbitrary commands remotely, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:44Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","provenance":"source","from":"NVD"},"epss":{"score":0.0107,"percentile":0.64824,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":9,"pulses":[{"name":"Known_Cve | Oct 24, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adb7414397c3ad4799aa4ce","created":"2026-10-23"},{"name":"Known_Cve | Oct 23, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ada23770d71749da2321a29","created":"2026-10-22"},{"name":"Known_Cve | Oct 22, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad8d3466c8181f05516bab7","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad78144340f998d3db4d0bc","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad62f761b14c745b837b947","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad4ddb44d734735b605dc2f","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad38c34c49c0273168a0f7d","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad23abd6cb9332fcbb88e3b","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ad0e94086fc75fcda994436","created":"2026-10-15"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.qnap.com/en/app-release-notes?keyword=HybridDesk%20Station&app=HD_Station&product-line=nas","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-101989","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101989","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47786","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":21.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.96,"detail":"percentile 0.6482"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}