Medium severity · published Oct 15, 2026
CVE-2026-34007
**RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()`
6.9
CVSS
1.4%
EPSS
No
On KEV
Description
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.
We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and later
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
Notes Station 3 · QNAP Systems Inc.
3.9.x before 3.9.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34007
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34007
www.qnap.com
https://www.qnap.com/en/app-release-notes?keyword=Notes%20Station%203&app=NotesStation3&product-line=nas
More from Notes Station 3
8.5
CVE-2026-34008
**Privilege Escalation** World-writable crontab path monitored and executed by root-owned process
8.4
CVE-2026-34009
**Container Escape** Host user home directory mounted with write access into application container
5.4
CVE-2024-27126
Notes Station 3
5.4
CVE-2024-27122
Notes Station 3
4.8
CVE-2026-39991
Stored Cross-Site Scripting (XSS) in Note Station file upload functionality