QNAP Security Reporting Platform

EU Cyber Resilience Act Compliance Reporting

In accordance with the EU Cyber Resilience Act (CRA), QNAP has established this single point of contact for reporting actively exploited vulnerabilities and confirmed severe incidents, so that reporting obligations are met within the statutory deadlines.

Submit a Report

Important Notes

Please provide a description of the vulnerability or incident, the currently known scope of impact, the affected product versions, and any supporting evidence
If you have preliminary evidence that the vulnerability is being actively exploited, please state this explicitly in your report and provide supporting material, such as attack logs or Indicators of Compromise (IoC)
For cases that fall within the scope of CRA reporting obligations, our internal handling procedures start in line with the statutory deadlines, such as an initial notification within 24 hours
All report content is treated as confidential and is used solely by QNAP PSIRT for security assessment and regulatory reporting
Once your report has been submitted, a dedicated security communications specialist will contact you
Learn about the QNAP Coordinated Vulnerability Disclosure Policy

What the CRA Compliance Reporting Platform Accepts

This platform accepts reports in the following two categories:

Category	Description
Actively exploited vulnerability	There is reliable evidence that a malicious actor has actually exploited the vulnerability on a system without authorization, rather than a merely known CVE or a general weakness
Confirmed severe security incident	A security incident with a severe impact on product security, including but not limited to a data breach, service disruption, or system compromise

The following fall within the scope of customer support (Customer Service - QNAP) and are not accepted by this platform:

Requests for technical support (NAS configuration, system updates, hardware repair)
Enquiries about publicly disclosed vulnerabilities (already listed in our security advisories)
Requests for technical support with installing patches
Vulnerabilities in third-party products, or enquiries about the details of third-party vulnerabilities
Vulnerabilities found on websites other than qnap.com
Malware found on mobile devices
Other general enquiries unrelated to security

If you would like to report a security vulnerability that has not been exploited and claim a bounty under the Bug Bounty Program, please check the eligibility criteria and how to submit on the Bug Bounty Program page.

The QNAP security team assessing and handling a reported incident

Reporting Channels and How They Differ

Please note: QNAP provides three separate reporting and service channels according to the nature of the issue. Please choose the channel that matches the situation you are facing.

Item	CRA Security Reporting This page	QNAP Customer Service Applies in most cases	Bug Bounty Program Security Bounty Program
Purpose	Reporting security incidents or exploited vulnerabilities that meet regulatory reporting criteria	Technical support, enquiries about known vulnerabilities, help with patching, and similar requests	Security vulnerabilities that have not been exploited and are eligible under the Bug Bounty Program
Handled by	QNAP PSIRT, within the statutory deadlines (such as 24-hour notification)	Customer service team	Bounty review team, assessed against the bounty rules
When to use	Security incidents subject to reporting obligations under the CRA or similar regulations	Most user issues	General, non-urgent vulnerability reports

How do I decide which channel to use?

First, consider the situation you are facing:

Is it about configuration, updates, repairs, or a known issue? → This falls within the scope of customer support (Customer Service - QNAP)
Do you have clear evidence that a vulnerability is being actively exploited, or has a severe security incident occurred? → This falls within the scope of this platform (CRA Security Reporting)

Please use the above to choose the right channel, so that your issue reaches the team best placed to handle it as quickly as possible.

How the scope of QNAP’s three reporting and service channels differs

Complete the CRA Security Report Form

Please provide full details of your report in the form below, so that the QNAP PSIRT team can complete its initial analysis and assessment as quickly as possible.

Please note that this form is only for reporting actively exploited vulnerabilities or confirmed severe security incidents. Once you have submitted it, a security communications specialist will be assigned to contact you.

To keep your report complete and accurate, and to support the subsequent assessment of statutory deadlines and regulatory filing, please be as detailed and specific as possible. If you have supporting material, such as attack logs, system logs, or proof-of-concept code, you can upload it with the form.

Everything you submit is treated as confidential and is used only for QNAP’s internal security assessment and regulatory reporting. It is not disclosed publicly, but it will be provided to the competent authorities where the regulations require it.

Encrypting Sensitive Information

If what you intend to submit involves highly sensitive technical details, such as exploitable vulnerability details, proof-of-concept code, or system access information, we strongly recommend encrypting it with the public PGP key at the bottom of this page before submitting, so that it cannot be accessed without authorization in transit.

Please choose how you would like to sign in

We encourage you to sign in with your QNAP account when reporting, so that the PSIRT team can verify your report quickly and keep you updated on its progress

Submit a CRA Security Report

Required fields

Reporter Full Name*

Please enter your full name.

Reporter E-mail*

Please enter a valid email address.

Affected Product*

Select the affected product model. If it is not listed (e.g., an app or software), choose "Others" and enter it manually.

Affected Version*

Select the affected firmware / OS version. If it is not listed, choose "Others" and enter it manually.

Report Title*

Briefly describe the vulnerability / incident.

Description*

What happened, how it was discovered, and what is known (e.g., device time zone, whether the device was rebooted after the incident).

Observed Impact*

Impact on products, systems, data, services, or users (e.g., whether other systems are affected).

Evidence / Source*

Evidence supporting this report and how the information was obtained (screenshots, logs, etc.). If an intrusion is involved, preserve evidence first and take a system image backup if necessary before performing any further operations.

Evidence files*

Upload evidence files.

Optional fields

Date / Time Observed

When you first observed the incident, in your local time.

Vulnerability ID

CVE / EUVD identifier.

Attack / Exploitation Method

How the attack or exploitation was carried out.

Indicators of Compromise (IoC)

IP, domain, URL, hash, etc.

Threat Actor / Campaign

Attacker or campaign, if known.

Reported to other authorities

Whether you have reported this incident to other organizations (local CERT, law enforcement, etc.).

Attachments

System event logs, PCAP, screenshots, PoC, samples. Please submit as an encrypted archive.

Total size limit for all attachments in this form: 35 MB.

By submitting this form you agree to the QNAP Privacy Policy.

Personal data provided by CRA security reporters will be processed and retained to the extent necessary in accordance with the QNAP Privacy Policy. QNAP applies protection measures appropriate to the sensitivity of the information.

Report submitted

Thank you for helping QNAP improve product security resilience. Every report you make helps keep users safer.