CVE-2025-66280 QTS, QuTS hero
Remote administrators can exploit an integer overflow in QNAP QTS and QuTS hero to compromise system security.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66280?
CVE-2025-66280 is a medium-severity vulnerability in Qnap Qts, published on 10 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later
Which versions are affected by CVE-2025-66280?
It affects 2 products.
Products include Qnap Qts, Qnap Quts Hero.
How do I fix CVE-2025-66280?
No fix has been published for CVE-2025-66280 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-66280 being exploited?
There is no known exploitation of CVE-2025-66280 in the wild and no public exploit code.
Other vulnerabilities in Qnap Qts
Sources
Also known as GHSA-25q9-p4j4-6rj7.