{"id":"CVE-2026-22896","aliases":["EUVD-2026-101872","GHSA-wqcf-pwr4-95x6"],"status":"published","title":"Stored XSS via Interface Name in Network \u0026 Virtual Switch App","description":"A cross-site scripting (XSS) vulnerability has been reported to affect Network \u0026 Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code.\n\nWe have already fixed the vulnerability in the following version:\nNetwork \u0026 Virtual Switch in QTS 5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QTS 5.2.1.2930 build 20241025 and later\nNetwork \u0026 Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later","severity":{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0036,"percentile":0.30218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-15T06:58:38Z","modified":"2026-10-15T19:17:38Z","products":[{"vendor":"qnap systems inc.","product":"network \u0026 virtual switch"}],"references":[{"url":"https://www.qnap.com/en/release-notes/qts/5.1.8.2823/20240712","tags":["release-notes"]},{"url":"https://www.qnap.com/en/release-notes/qts/5.2.1.2930/20241025","tags":["release-notes"]},{"url":"https://www.qnap.com/en/release-notes/qutscloud/c5.2.4.3041/20250211","tags":["release-notes"]},{"url":"https://www.qnap.com/en/release-notes/quts_hero/h5.1.8.2823/20240712","tags":["release-notes"]},{"url":"https://www.qnap.com/en/release-notes/quts_hero/h5.2.1.2929/20241025","tags":["release-notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22896"},{"url":"https://github.com/advisories/GHSA-wqcf-pwr4-95x6"}],"sources":{"cve":[{"id":"CVE-2026-22896","title":"Stored XSS via Interface Name in Network \u0026 Virtual Switch App","description":"A cross-site scripting (XSS) vulnerability has been reported to affect Network \u0026 Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code.\n\nWe have already fixed the vulnerability in the following version:\nNetwork \u0026 Virtual Switch in QTS 5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QTS 5.2.1.2930 build 20241025 and later\nNetwork \u0026 Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later","status":"published","published":"2026-10-15T06:58:38.222Z","modified":"2026-10-15T18:25:22.923Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-101872","description":"A cross-site scripting (XSS) vulnerability has been reported to affect Network \u0026 Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code.\n\nWe have already fixed the vulnerability in the following version:\nNetwork \u0026 Virtual Switch in QTS 5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QTS 5.2.1.2930 build 20241025 and later\nNetwork \u0026 Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later","status":"published","published":"2026-10-15T06:58:38Z","modified":"2026-10-15T18:25:22Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:00:10.766559Z"}],"ghsa":[{"id":"GHSA-wqcf-pwr4-95x6","title":"A cross-site scripting (XSS) vulnerability has been reported to affect Network \u0026 Virtual Switch....","description":"A cross-site scripting (XSS) vulnerability has been reported to affect Network \u0026 Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code.\n\nWe have already fixed the vulnerability in the following version:\nNetwork \u0026 Virtual Switch in QTS 5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QTS 5.2.1.2930 build 20241025 and later\nNetwork \u0026 Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later","status":"published","published":"2026-10-15T09:30:33Z","modified":"2026-10-15T09:30:37Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:13:35.252436Z"}],"nvd":[{"id":"CVE-2026-22896","description":"A cross-site scripting (XSS) vulnerability has been reported to affect Network \u0026 Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code.\n\nWe have already fixed the vulnerability in the following version:\nNetwork \u0026 Virtual Switch in QTS 5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QTS 5.2.1.2930 build 20241025 and later\nNetwork \u0026 Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later\nNetwork \u0026 Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later","status":"published","published":"2026-10-15T07:17:59.303Z","modified":"2026-10-15T19:17:38.27Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:59.328869Z"}]}}