High severity · published Oct 29, 2026
CVE-2025-62841
Hard-coded Cryptographic Key #2
New
8.7
CVSS
–
EPSS
No
On KEV
Description
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.
We have already fixed the vulnerability in the following version:
HBS 3 Hybrid Backup Sync 26.4.0.521 and later
Hybrid Backup Sync 26.4.0.521 and later
Hybrid Backup Sync 26.4.1.563 and later
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H3
HBS 3 Hybrid Backup Sync · QNAP Systems Inc.
26.4.x before 26.4.0.521 · source: vendor
HB
Hybrid Backup Sync · QNAP Systems Inc.
26.4.x before 26.4.0.521; 26.4.x before 26.4.1.563 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62841
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62841
release-notes
https://www.qnap.com/en/app-release-notes?keyword=HBS%203&app=HybridBackup&product-line=nas
release-notes
https://www.qnap.com/en/app-release-notes?keyword=Hybrid&app=HybridBackup&product-line=nas
More from HBS 3 Hybrid Backup Sync
9.8
CVE-2024-50388
HBS 3 Hybrid Backup Sync
9.1
CVE-2024-53695
HBS 3 Hybrid Backup Sync
8.7
CVE-2025-62839
Hard-coded Cryptographic Key #1
7.8
CVE-2025-62842
HBS 3 Hybrid Backup Sync
3.3
CVE-2025-62840
HBS 3 Hybrid Backup Sync
