---
id: CVE-2026-34007
title: >-
  An OS command injection vulnerability has been reported to affect Notes
  Station 3
summary: >-
  An OS command injection vulnerability has been reported to affect Notes
  Station 3. If exploited, the vulnerability could allow remote attackers to
  execute arbitrary commands.


  We have already fixed the vulnerability in the following vers…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-78
vendor: QNAP Systems Inc.
product: Notes Station 3
affected:
  - notes_station_3 >= 3.9.x < 3.9.11
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:32:39.893'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34007'
references:
  - url: >-
      https://www.qnap.com/en/app-release-notes?keyword=Notes%20Station%203&app=NotesStation3&product-line=nas
    label: security@qnapsecurity.com.tw
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T13:34:26.619098Z'
cvssSource: cna
ingestedAt: '2026-10-15T09:59:33.286Z'
epss: 0.01446
epssPercentile: 0.73172
---

## Overview

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and later

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.