---
id: CVE-2026-34007
title: >-
  An OS command injection vulnerability has been reported to affect Notes
  Station 3
summary: >-
  An OS command injection vulnerability has been reported to affect Notes
  Station 3. If exploited, the vulnerability could allow remote attackers to
  execute arbitrary commands.


  We have already fixed the vulnerability in the following vers…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-78
vendor: QNAP Systems Inc.
product: Notes Station 3
affected:
  - notes_station_3 >= 3.9.x < 3.9.11
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T10:17:13.320'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34007'
references:
  - url: >-
      https://www.qnap.com/en/app-release-notes?keyword=Notes%20Station%203&app=NotesStation3&product-line=nas
    label: security@qnapsecurity.com.tw
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-10-15T09:59:33.286Z'
---

## Overview

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and later

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.