Is CVE-2021-28799 (QNAP NAS Improper Authorization) being exploited in the wild?

Yes. CISA added CVE-2021-28799 to its Known Exploited Vulnerabilities catalogue on 31 March 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.

What being “exploited in the wild” means for this CVE

For a CVE like this, “exploited in the wild” means more than a theoretical flaw or a proof of concept. It means the vulnerability has crossed into active attacker use, so the question is no longer whether it matters, but whether your NAS is exposed, reachable, and already being targeted. For operators, that shifts the priority from routine maintenance to urgent exposure checks and response readiness.

Because CISA has placed CVE-2021-28799 in the CISA Known Exploited Vulnerabilities Catalog, the practical assumption should be that exploitation pressure exists and that delay increases risk. The right response is to treat the device as a live security asset, not a background appliance.

Why QNAP NAS authorization flaws become high-value targets

NAS devices are attractive because they often sit at the center of file sharing, backups, sync jobs, and remote admin access. When an authorization failure lets a remote attacker log in, the consequence is not just unauthorized access to one interface. It can become a path to stored files, backup repositories, and adjacent systems that trust the NAS for data movement or recovery.

That is why the issue is particularly sensitive when the device runs internet-facing services or remote-management features. A flaw in access control on a storage platform can create a disproportionate blast radius, especially if the device also holds credentials, sync tokens, or recovery data that other systems depend on. For broader context on the class of problems that make these devices high-risk, see the IoT Security Guide.

What to check first on an exposed QNAP device

Start with exposure, not assumptions. Confirm whether the NAS is reachable from the internet, whether HBS 3 is installed and active, and whether the device is exposed through VPN, port forwarding, reverse proxy, or remote administration paths. If the device is not directly reachable, still verify whether any upstream service or relay exposes the vulnerable component indirectly.

Then check for signs that the device has already been used beyond normal administrative activity. Look for unexpected login events, new admin accounts, changed remote access settings, modified backup jobs, unfamiliar shares, or outbound connections that do not fit the normal backup pattern. For a structured response path when a CVE is already known to be exploited, the Zero-Day and Exploited Vulnerabilities Guide is the most relevant internal starting point.

Risk and Threat Considerations

This vulnerability matters because authorization failures on NAS platforms can turn a storage device into an intrusion foothold. Once an attacker can authenticate or act as if they are authorized, the next step is often data access, credential harvesting, backup tampering, or persistence through trusted administrative paths.

Failure mechanism: The flaw lets a remote attacker bypass intended access checks, so the device accepts actions or sessions that should have been denied. In practice, that can support unauthorized login, privilege misuse, and follow-on access to files, backup content, or management functions.

Impact: The most likely outcomes are data exposure, backup compromise, lateral movement, and ransomware staging. CISA’s ransomware linkage is a strong signal that defenders should assume the vulnerable device may be used as an entry point or as a pressure point in broader extortion activity.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM-01 — Monitoring for Unauthorized Use	Active exploitation makes continuous monitoring for unauthorized use directly relevant.
	RS.MI-03 — Containment and Mitigation	Exploited vulnerabilities require containment and mitigation actions, not just scheduled patching.
Recommendation — Monitor the NAS and adjacent services for unauthorized access and abnormal authentication patterns. Contain or isolate the NAS while you apply mitigation and validate exposure.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	A KEV-listed CVE needs prioritized discovery, remediation and verification.
	CIS-8 — Audit Log Management	Suspicious logins and admin changes are key evidence after active exploitation.
Recommendation — Prioritise and remediate the vulnerable NAS under a continuous vulnerability management process. Centralise and review NAS authentication and admin logs for compromise indicators.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue is an actively exploited software flaw requiring timely remediation.
Recommendation — Apply the vendor fix or mitigation and verify the vulnerable component is no longer exposed.

Practitioner Guidance

What to prioritise: If the NAS is internet-exposed or remotely administered, treat remediation and compromise assessment as urgent and parallel tasks. Patch or mitigate first, then validate whether the device shows signs of unauthorized access, because active exploitation can be fast and quiet.

What to verify: Confirm whether any accounts, sessions, backup credentials, or remote-access settings were changed during the exposure window. If the NAS participates in automated backup or sync flows, verify those downstream connections as well, since the vulnerable device may have exposed more than its own login surface.

Decision rule: If you cannot patch immediately, isolate the device from untrusted networks, restrict administrative access to known management paths, and monitor for anomalous authentication or file activity until the fix is applied. If there is evidence of compromise, rotate any credentials or tokens stored on or used by the NAS before restoring trust.

Practitioner takeaway: For exploited NAS flaws, the key question is not only whether the device is patched, but whether it still deserves to be trusted at all. Once a storage appliance is known to have been reachable during active exploitation, verify integrity before you resume business-as-usual operations.