VendorsInfrastructure
QNAP
QNAP Systems makes network-attached storage (NAS) devices and the QTS, QuTS hero and QuTScloud operating systems, plus NAS apps such as Photo Station and Helpdesk.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- none on record
- Incidents on record
- 0
Response to exploited bugs
Not rated. No reviewed zero-days yet.
Fixing privately reported bugs
66 range 54ā78rank 17 of 20
Provisional 10 private reports, published on 7 dates. Not enough yet for a firm grade.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a Dā. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
- Fixing privately reported bugs: C+ (66), provisional. Median 226 days from private report to fix (10 cases, 1 with a vendor fix date). 8 of 10 took longer than ZDI's 120-day deadline.
- No exploited incidents on record for the last 36 months.
Response to exploited bugs: sub-scores
- Time to first advisoryNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to first fixNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to fix all versionsNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- OpennessAdvisories available by RSS623 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedMedian 226 days from private report to fix (10 cases, 1 with a vendor fix date)66C+10 cases, low confidence, weight 100%
Response fingerprint
No exploited incidents on record in the last 24 months.
Private reports
Median 226 days, 80% over 120 days, 0 published unpatched
Bugs reported privately to QNAP by ZDI or Project Zero.
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 15 Oct 2026 | ZDI-26-776CVE-2018-10388, CVE-2018-10389 | TS-453E | 315to publication | Yes |
| 15 Apr 2026 | ZDI-26-292CVE-2026-22898 | TS-453E | 58to vendor fix, 21 Mar 2026 | Yes |
| 30 Mar 2026 | ZDI-26-198, ZDI-26-199, ZDI-26-200, ZDI-26-201, ZDI-26-216, ZDI-26-237, ZDI-26-239, ZDI-26-240, ZDI-26-241, ZDI-26-242, ZDI-26-243CVE-2025-11837, CVE-2025-59388, CVE-2025-62840, CVE-2025-62842, CVE-2025-62843, CVE-2025-62844, CVE-2025-62845, CVE-2025-62846, CVE-2025-62847, CVE-2025-62848, CVE-2025-62849 | TS-453E; QHora-322 | 132to publication | Yes |
| 30 Mar 2026 | ZDI-25-871, ZDI-26-244CVE-2024-13087, CVE-2024-13088 | QHora-322 | 472to publication | Yes |
| 16 Mar 2026 | ZDI-26-202CVE-2025-59389 | TS-453E | 91to publication | Yes |
| 31 Jul 2025 | ZDI-25-742 | TS-464 | 224to publication | Yes |
| 31 Jul 2025 | ZDI-25-756, ZDI-25-757 | QHora-322 | 227to publication | Yes |
| 31 Jul 2025 | ZDI-25-734, ZDI-25-735, ZDI-25-736, ZDI-25-737, ZDI-25-738, ZDI-25-739, ZDI-25-740, ZDI-25-741, ZDI-25-743, ZDI-25-744, ZDI-25-745, ZDI-25-746, ZDI-25-747, ZDI-25-748, ZDI-25-749, ZDI-25-750, ZDI-25-751, ZDI-25-752, ZDI-25-753, ZDI-25-754, ZDI-25-755, ZDI-25-758, ZDI-25-759, ZDI-25-760CVE-2024-50387, CVE-2024-50388, CVE-2024-50389 | QHora-322; TS-464 | 241to publication | Yes |
| 12 Aug 2024 | ZDI-24-472, ZDI-24-474, ZDI-24-1123CVE-2024-32764, CVE-2024-32765, CVE-2024-32766 | TS-464 | 271to publication | Yes |
| 21 Jun 2024 | ZDI-24-470, ZDI-24-471, ZDI-24-473, ZDI-24-475, ZDI-24-476, ZDI-24-823, ZDI-24-824, ZDI-24-825, ZDI-24-826, ZDI-24-827CVE-2023-51364, CVE-2023-51365, CVE-2024-21899, CVE-2024-21901, CVE-2024-27124, CVE-2024-32764, CVE-2024-32766 | TS-464 | 225to publication | Yes |
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get QNAP's own alerts
- RSSQNAP security advisories RSSAdd the advisory feed to a feed reader or chat integration.
- XQNAP on XFollow the account and turn on notifications.
- Advisory pageQNAP security advisoriesCheck the advisory page. It has no push channel.
Grade not rated.