Medium severity · published Sep 18, 2026
CVE-2024-27123
A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent
5.2
CVSS
0.2%
EPSS
No
On KEV
Description
A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data.
We have already fixed the vulnerability in the following version:
QcalAgent 1.1.9 and later
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QC
QcalAgent · QNAP Systems Inc.
1.1.0 before 1.1.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-27123
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-27123
www.qnap.com
https://www.qnap.com/en/security-advisory/qsa-24-54
More from QcalAgent
8.7
CVE-2026-41544
Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint