QNAP NAS: updates and ransomware protection

Updated November 2026

The big QNAP ransomware waves, Qlocker in 2021 and DeadBolt in 2022, hit NAS units that were reachable from the internet and missing patches. To avoid the same fate, set QTS to install critical updates automatically, update apps too, remove UPnP and router port forwarding, check that your model still gets security fixes, and keep a backup copy the NAS itself cannot delete.

Is your model still supported?

QNAP’s Product Support Status page lists two columns that matter for security:

OS Updates and Maintenance: Full means the model still gets new QTS versions. Otherwise you see the last QTS version the model can run, or an end date.
Technical Support and Security Updates: Active means full support and security patches. A date is when limited support and security updates end.

QNAP adds a warning: the latest version contains fixes for all security issues, but because of architectural changes, not every issue is fixed in older versions. A model stuck on an old QTS line can stay vulnerable even before its end date.

Examples from QNAP’s Product Support Status, as of November 2026
Model	OS updates	Security updates
TS-233, TS-433, TS-464	Full	Active
TS-251D, TS-453A	Full	Active (no longer sold)
TS-230, TS-253D	Full	Until December 31, 2027
TS-431K	Last: QTS 5.2	Until December 31, 2027
TS-228A	Full	Ended December 31, 2025
TS-431X	Last: QTS 5.2	Ended December 31, 2024
TS-231P, TS-431P	Last: QTS 5.2	Ended December 31, 2023
TS-212P	Last: QTS 4.3.3	Ended October 2022

Find your model name in Control Panel > System Status > System Information, then look it up. If security updates have ended, keep the NAS strictly on the LAN, remove all remote access, and plan a replacement (see end-of-life systems).

Current firmware

As of November 2026, QTS 5.2 and QuTS hero h5.2 are the production branches for most models. QNAP’s release notes list QTS 6.1 builds as public beta in October 2026. An example of why updates matter: advisory QSA-26-10 (June 17, 2026) fixed 18 CVEs in QTS, QuTS hero, QuTS cloud and QVP, including some that could be triggered without signing in. The fixed versions are QTS 5.2.9.3499 and QuTS hero h5.2.9 or later.

To update by hand, sign in as an administrator and go to Control Panel > System > Firmware Update, then under Live Update click Check for Update. You can also download the firmware for your exact model from the QNAP Download Center, extract the .img file and upload it under Manual Installation. The NAS restarts to install.

Set up automatic updates

Go to Control Panel > System > Firmware Update > Firmware Update > Firmware Update Settings. Click Check for Updates first, then pick a policy:

QTS 5.2 firmware update policies
Policy	What it does
Automatically install critical updates	Installs security-critical firmware only. The minimum you should choose.
Automatically install quality updates	Also installs bug-fix releases.
Automatically install the latest updates	Installs every new firmware release.
Notify me, do not automatically update	Alerts only. You must act.
Do not notify me, do not automatically update	Nothing. Avoid this.

Set the Update/Notification time to a quiet hour, for example 03:00. The update starts within one hour of that time, QTS warns 12 hours ahead, and you can postpone it by up to 23 hours. While it runs, all tasks are suspended and the NAS restarts.

Updates can be skipped silently. QTS cancels an automatic update if there are live iSCSI or Fibre Channel connections or running virtual machines in Virtualization Station. If the NAS hosts VMs or LUNs, schedule manual maintenance windows instead and add a notification rule for firmware events so you see what happened.

Firmware updates do not update apps. In App Center, update all installed apps, and turn on automatic app updates in the App Center settings. Qlocker and the September 2022 DeadBolt wave both exploited apps (Hybrid Backup Sync and Photo Station), not QTS itself. Remove apps you do not use.

Follow QNAP security advisories

QNAP publishes advisories as QSA-YY-NN at qnap.com/en/security-advisories, with the impact, status, CVEs and fixed versions. Subscribe by email on that page or add the RSS feed https://www.qnap.com/en/security-advisory/feed to your reader. Recent examples include QSA-26-18 (PHP “PHP2Shell”, October 22, 2026) and QSA-26-16 and QSA-26-17 (Linux kernel privilege escalation, May 2026).

Remove internet exposure

This is the single most important step. QNAP’s own advice after Qlocker and DeadBolt was not to connect a NAS directly to the internet.

UPnP: open myQNAPcloud > Auto Router Configuration and make sure Enable UPnP port forwarding is cleared. QTS 5.2 ships with UPnP off, but older setups often turned it on.
Router: in the router’s Port Forwarding, Virtual Server or NAT settings, delete rules that point to the NAS, especially the management ports 8080 and 443.
myQNAPcloud: do not publish NAS services. If you need remote file access, use myQNAPcloud Link (a relayed connection, no open ports) and set access control to Private or Customized.
Remote admin: use a VPN, either on your router or with QNAP’s QVPN Service, and reach QTS by its LAN address.
Disable SSH and Telnet unless you need them. Enable IP access protection and account access protection in Control Panel > System > Security.

Then test from outside: from a phone on mobile data, try to open your public IP address on ports 8080 and 443. Nothing should answer. See also firewall basics.

Lock down accounts

Create a new administrator account and disable the default admin account.
Turn on 2-step verification for every administrator.
Use long, unique passwords and remove unknown accounts and needless permissions.
Install only digitally signed apps, and remove unknown apps from App Center.

Security Center, Security Counselor and Malware Remover

Security Center arrived with QTS 5.2 and QuTS hero h5.2 (released August 2024). Its File Activity Monitoring compares file changes with normal levels and flags unusual activity that may be ransomware. You can choose the response: switch volumes to read-only, take a snapshot, or pause scheduled snapshots so encrypted data does not push out good snapshots. Turn it on and pick the read-only response for shares that rarely change.

Security Counselor scans the NAS against a security policy and suggests fixes for weak settings. Malware Remover runs instant or scheduled malware scans. Schedule both, and act on any finding.

Snapshots and off-NAS backups

Snapshots record the state of a volume or LUN so you can restore files or roll back the whole volume. They need a model that supports snapshots and at least 1 GB of RAM. Set a schedule in Storage & Snapshots (for example hourly, kept for 14 days) with a retention policy.

Snapshots on the same NAS are not enough. Qlocker ran with elevated rights and deleted all snapshots before it encrypted files. Protect against that:

Use Snapshot Replica to copy snapshots into a snapshot vault on a second NAS that has different admin credentials and no remote access.
Back up with Hybrid Backup Sync to another site or cloud storage that supports object lock or versioning the NAS cannot erase.
Follow the 3-2-1 rule: three copies, two media, one off site. RAID is not a backup; it only covers disk failure.
Practise a restore. See restoring from backup.

Past ransomware campaigns and lessons

Every wave hit NAS units that were reachable from the internet and not fully updated.

Qlocker (April 2021)

QNAP released a fixed Hybrid Backup Sync (HBS 3) build, 16.0.0415, on April 16, 2021 for issues in advisory QSA-21-13. From April 21, users reported attacks. Qlocker used a patched HBS flaw on unpatched, internet-facing NAS units, gained elevated rights, deleted all snapshots, and packed user files into password-protected .7z archives with the NAS’s built-in 7-Zip tool. Lesson: apps need patching as urgently as firmware, and snapshots on the same box can be erased.

DeadBolt (2022)

DeadBolt encrypted QNAP NAS units from late January 2022. Censys counted 4,988 infected services out of about 130,000 internet-facing QNAP devices at the January peak, and Censys reported that QNAP then pushed a forced firmware update. A May 2022 wave hit devices on QTS 4.3.6 and 4.4.1, mainly TS-x51 and TS-x53 models, and QNAP told owners to update QTS, disable UPnP and router port forwarding, and use a VPN or myQNAPcloud Link instead. On September 3, 2022 a new campaign hit internet-exposed Photo Station (CVE-2022-27593, advisory QSA-22-24, fixed in Photo Station 6.1.2 for QTS 5.0.1 and matching builds for older QTS). Lesson: exposure is the root cause; updates alone left a window between each attack and its fix.

If the NAS is already hit

QNAP’s advice after Qlocker: do not shut down, restart or update the NAS, because that can destroy recovery options. Disconnect it from the internet (leave it powered on), contact QNAP technical support, and follow our ransomware response steps. Restore only after you have closed the exposure that let the attacker in.