Key points
- The flaw affects Notes Station 3 versions prior to 3.9.11.
- A fix is available in version 3.9.11 and later.
- The vulnerability carries a CVSS score of 8.5.
QNAP Systems Inc. has released a security update for Notes Station 3 to address a critical permission error. Users running versions older than 3.9.11 must upgrade immediately. The vendor confirmed that version 3.9.11 and subsequent releases contain the necessary corrections. This update resolves an issue where incorrect permissions could be assigned to critical system resources.
In plain English
The vulnerability, tracked as CVE-2026-34008, stems from an incorrect permission assignment. According to the National Vulnerability Database, this flaw allows a local attacker who has already obtained a user account to compromise system security. The issue is classified under CWE-732, which relates to incorrect permission assignment for critical resources. It does not require remote network access to exploit.
The background
The flaw carries a CVSS score of 8.5, which rates it as high severity. This rating reflects the potential impact on system integrity and confidentiality. As Patch Review reported on 2026-10-14, Microsoft also released patches for privilege escalation flaws in .NET and SmartScreen during the same period. However, this specific issue is isolated to QNAP’s Notes Station application.
What changes now
Administrators should verify their current Notes Station 3 version immediately. If the version number is lower than 3.9.11, the system is vulnerable. The vendor has provided the fix in the 3.9.11 release. No other versions or products are listed as affected in this specific advisory. Users should check their device settings to confirm the installed version before proceeding with any updates.
Who needs to act first
Teams usually prioritize systems exposed to internal users or shared workspaces. Check whether any devices run older versions of the application. Roll out the update to a small test group first to ensure stability. Back up existing data before applying changes. If a full update is not possible immediately, restrict access to the application. Monitor logs for unusual permission changes or account activity. This approach reduces exposure while the fix is deployed broadly.
What to do and how to stay safe: QNAP
- Check the installed version of Notes Station 3 on all managed devices.
- Upgrade to version 3.9.11 or later once the vendor provides the update.
- Review user accounts for any signs of unauthorized privilege changes.
- Restrict access to the application if an immediate update is not feasible.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-34008?
The vulnerability has a CVSS score of 8.5, which is rated as high severity.
Which versions of Notes Station 3 are affected?
Versions prior to 3.9.11 are affected by this incorrect permission assignment flaw.
Is a fix available for this vulnerability?
Yes, QNAP has fixed the vulnerability in Notes Station 3 version 3.9.11 and later.
