EN PT-BR
← Voltar ao feed
high exploit público

CERT-FR Advisory: QNAP QNE OS Vulnerabilities Allow Remote Code Execution

1 fonte(s) · 1 atualização(ões) · publicado 01/11/2026 21:00 · coletado há 1 hora

CERT-FR published advisory CERTFR-2026-AVI-1437 detailing multiple vulnerabilities in QNAP QNE (ADRA) that allow an attacker to achieve remote arbitrary code execution. The flaws affect QNE (ADRA) versions prior to 1.0.7.q327. The advisory references QNAP's security bulletin qsa-26-19 (30 October 2026) and a prior CERT-FR alert CERTFR-2026-ALE-014 (21 October 2026). Two CVEs are tracked: CVE-2026-109618 and CVE-2026-109619.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1437 reports multiple vulnerabilities in QNAP QNE (ADRA), tracked as CVE-2026-109618 and CVE-2026-109619. According to the advisory, they let an attacker achieve remote arbitrary code execution. QNE (ADRA) versions before 1.0.7.q327 are affected, and the fix is referenced in QNAP bulletin qsa-26-19 of 30 October 2026. The sources do not give per-CVE details, severity, or the authentication or configuration needed.

Como foi descoberta

The advisory says only that multiple vulnerabilities were discovered in QNAP QNE and does not say who found them or how. It cites QNAP's bulletin qsa-26-19 (30 October 2026) and an earlier CERT-FR alert, CERTFR-2026-ALE-014 of 21 October 2026, but does not say whether that alert concerns these same flaws.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 14:21.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • CVE-2026-109618 and CVE-2026-109619: enable remote code execution in QNAP QNE (ADRA).
  • Affected: QNE (ADRA) versions prior to 1.0.7.q327.

Remediação

  • Apply the patches referenced in QNAP's security bulletin qsa-26-19.
  • Consult CERT-FR alert CERTFR-2026-ALE-014 for prior guidance.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 01/11/2026 21:00 · coletado 04/11 14:01 primeiro registro

    CERT-FR Advisory: QNAP QNE OS Vulnerabilities Allow Remote Code Execution

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1437 detailing multiple vulnerabilities in QNAP QNE (ADRA) that allow an attacker to achieve remote arbitrary code execution. The flaws affect QNE (ADRA) versions prior to 1.0.7.q327. The advisory references QNAP's security bulletin qsa-26-19 (30 October 2026) and a prior CERT-FR alert CERTFR-2026-ALE-014 (21 October 2026). Two CVEs are tracked: CVE-2026-109618 and CVE-2026-109619.

    Technical Details

    • CVE-2026-109618 and CVE-2026-109619: enable remote code execution in QNAP QNE (ADRA).
    • Affected: QNE (ADRA) versions prior to 1.0.7.q327.

    Remediation

    • Apply the patches referenced in QNAP's security bulletin qsa-26-19.
    • Consult CERT-FR alert CERTFR-2026-ALE-014 for prior guidance.