CVE-2026-34009: high-severity vulnerability in QNAP Systems Inc. Notes Station 3
**Container Escape** Host user home directory mounted with write access into application container
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.4epss 0.1%
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and later
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
QNAP Systems Inc. · Notes Station 3Related CVEs — QNAP Systems Inc. Notes Station 3
In the same product, most dangerous first.
CVE-2024-38644HIGHNotes Station 3EPSS 1.6%CVE-2026-34007MEDIUM**RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()`EPSS 1.4%CVE-2024-38643CRITICALNotes Station 3EPSS 0.9%CVE-2024-38645CRITICALNotes Station 3EPSS 0.6%CVE-2026-39991MEDIUMStored Cross-Site Scripting (XSS) in Note Station file upload functionalityEPSS 0.3%CVE-2024-27126MEDIUMNotes Station 3EPSS 0.3%