← CVE catalog

CVE-2021-28799

Critical CVSS 10 Known exploited

Published 2021-05-13 · last changed 2026-06-17 · added to CISA KEV 2022-03-31

This one is being exploited in the wild.

CISA added CVE-2021-28799 to the Known Exploited Vulnerabilities catalog on 2022-03-31. Federal agencies are required to remediate it on a deadline. If you have affected machines, this is the class of finding that moves ahead of the rest of the queue.

The fix

We hold no Microsoft remediation data for CVE-2021-28799, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .

Sources

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H