Is CVE-2022-27593 (QNAP Photo Station Externally Controlled Reference) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2022-27593 to its Known Exploited Vulnerabilities catalogue on 8 September 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files.

What “exploited in the wild” means for CVE-2022-27593

For a CVE question, the practical answer is not just whether a flaw exists, but whether there is credible evidence that attackers are actively using it. Here, that matters because CISA has already treated the issue as operationally real, not theoretical. For exposed QNAP Photo Station deployments, the key question is whether internet-facing systems were reachable before the vulnerability was removed or mitigated.

The direct implication is that this should be handled as an active exposure event, not a routine cataloguing exercise. When a vulnerability is in the Known Exploited Vulnerabilities catalogue, defenders should assume exploitation is plausible wherever the vulnerable service is exposed and reachable. The safest interpretation is that internet-facing QNAP NAS running the affected Photo Station component deserve immediate review.

CISA Known Exploited Vulnerabilities Catalog is the authoritative place to confirm whether the vulnerability is still listed and to see the required remediation posture.

Why the QNAP Photo Station issue is security-relevant

This vulnerability matters because it sits at the intersection of externally reachable storage services, file manipulation, and internet exposure. An externally controlled reference problem can let an attacker influence what resource is accessed or modified, which is especially dangerous when the affected software can touch system files. In practice, that can turn a web-facing application weakness into broader host compromise or persistence risk.

QNAP NAS devices are often deployed as shared infrastructure, so one exposed appliance can become a stepping stone into stored data, local credentials, or adjacent management interfaces. That makes exposure assessment important even if the NAS is not directly business critical on paper. Internet reachability, weak segmentation, and delayed patching are what usually determine whether the issue becomes an incident.

IoT Security Guide is useful here because NAS and similar edge appliances need the same discipline around exposure reduction, segmentation, and firmware hygiene as other connected devices.

What defenders should do first

Start by confirming whether any QNAP systems still expose Photo Station to the internet, including through forwarded ports, reverse proxies, or stale DNS records. Then verify whether those instances were reachable before remediation. If the service was externally available, treat the environment as requiring both patch validation and compromise assessment, especially where the device stores sensitive files or administrative credentials.

Direct readers to the vendor advisory for version-specific remediation steps, because patch and configuration details belong there, not in a summary page. Use NIST Cybersecurity Framework 2.0 as the organising lens for identify, protect, detect, respond, and recover actions, and use NIST National Vulnerability Database to cross-check the record and any linked references.

If patching cannot happen immediately, isolate the NAS from the public internet, restrict administrative access, and review logs for unusual file access or changes. For exposed file-serving or content-management components, the key decision is whether the system should remain online at all before the flaw is removed.

Risk and Threat Considerations

Internet-facing NAS appliances are attractive targets because they often sit close to valuable data while receiving less scrutiny than core servers. Once a flaw is publicly known and added to KEV, attackers can reuse scanning and exploitation patterns at scale, and ransomware operators often prioritise exactly this kind of reachable edge service.

Failure mechanism: An externally controlled reference lets a remote user influence a resource lookup or file path, which can lead to unauthorized modification of local system files when the application trusts attacker-controlled input.

Impact: The likely outcomes include data tampering, service disruption, persistence on the appliance, and a higher chance of broader compromise if the NAS is connected to shared credentials, backups, or administrative networks.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.AM-01 — Asset Inventory	This CVE demands knowing which NAS appliances expose Photo Station.
	PR.AA-05 — Identity Management, Authentication and Access Control	Exposed NAS admin access and service access affect exploitation blast radius.
	DE.CM-08 — Vulnerability Scans	Active exploitation calls for validation of exposure and missed remediation.
Recommendation — Inventory exposed QNAP appliances and identify every internet-reachable instance. Restrict administrative and service access to the NAS with least privilege. Scan for vulnerable QNAP instances and verify remediation status promptly.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The issue requires identifying and tracking vulnerable assets under active exploitation.
	SI-2 — Flaw Remediation	The vulnerability requires prompt remediation or compensating mitigation.
	AU-6 — Audit Record Review, Analysis, and Reporting	Evidence of exploitation depends on reviewing logs and change activity.
Recommendation — Continuously scan QNAP assets and prioritize removal of KEV-listed exposure. Apply vendor remediation or compensate by removing exposure until fixed. Review NAS logs and alert on suspicious file or configuration changes.
OWASP ASVS	V15 — Secure Coding and Architecture	Externally controlled reference flaws are application-architecture weaknesses.
Recommendation — Eliminate attacker-controlled resource references in exposed web components.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exposure needs prioritised vulnerability handling and verification.
Recommendation — Prioritize and remediate KEV-listed vulnerabilities on internet-facing assets.

Practitioner Guidance

What to prioritise: Treat public exposure and patch status as the first decision point. If the device is internet reachable and Photo Station is enabled, the risk is materially higher than the same flaw on an isolated internal appliance.

What to verify: Confirm whether the NAS has been exposed long enough for exploitation to be credible, then check for unexpected file changes, new admin accounts, altered web content, or other signs of post-exploitation activity. If the appliance stores backup material or identity-related secrets, widen the review to those assets as well.

Decision rule: If the device cannot be patched immediately, remove external reachability before spending time on deeper forensic analysis. Containment first is the right call when the vulnerable service is both public and known to be exploited.

Practitioner takeaway: For KEV-listed flaws, the meaningful question is not whether exploitation is possible, but whether your exposure path was open long enough for it to matter, and whether you can prove the appliance was not already altered.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org