TerraMaster Forum

Hi TerraMaster Team,

I would like to ask whether the security vulnerability **CVE-2026-98432** has already been fixed in **TOS 7.0.1422**.

Exploit reference:
https://sploitus.com/exploit?id=4146367 ... 0BCD52ACC6

My NAS is currently running TOS 7.0.1422, and the kernel reports:

```
admdu@DUNAS01:/# uname -r
6.12.63+
```

The trailing `+` suggests that TerraMaster is using a custom-built or modified kernel.

Could you please confirm:

1. Is CVE-2026-98432 already patched in TOS 7.0.1422?
2. Has the security fix been backported into TerraMaster's custom kernel (`6.12.63+`)?
3. Is there an official security advisory or changelog confirming the fix?

Since the kernel version alone does not confirm whether the vulnerability has been patched, an official clarification would be appreciated.

siyarbekir47 wrote: ↑Yesterday, 17:25

Thank you very much for bringing this to our attention and sharing the detailed exploit reference.

We have noted the report regarding CVE-2026-98432 and are actively evaluating and verifying its impact. System security is our top priority—our engineering team is working on the remediation and will roll out a security patch in an upcoming TOS update as soon as possible.

In the meantime, as a general security precaution against remote network vulnerabilities, we advise keeping your NAS within a protected local network and avoiding exposing ports directly to the public internet or placing the device in a DMZ.

Thank you again for your vigilance and continuous support!

Thank you for your response.

However, this is a rather generic statement that doesn't address the actual security concerns or provide any concrete technical information.

CVE-2026-98432 has a reported CVSS score of 9.8 (Critical) and affects the Linux kernel's TCP networking stack. My NAS is running kernel `6.12.63+`, and there is still no confirmation whether the relevant upstream fix has been backported.

Your statement that the engineering team is still "evaluating and verifying its impact" is concerning, given that this is a documented critical vulnerability with a publicly available exploit.

Simply advising users to avoid exposing their NAS to the internet is not a realistic solution. Many of us run services that are intentionally accessible from the public internet. Taking these services offline indefinitely defeats much of the purpose of operating a NAS. Furthermore, restricting access to a LAN does not eliminate the underlying vulnerability, as internal systems can also be compromised.

I would therefore appreciate concrete answers:

1. Does TOS 7.0.1536 already include a fix for CVE-2026-98432?
2. If not, what is the estimated timeline (ETA) for a security patch?
3. Can TerraMaster provide a technical mitigation that does not require disabling essential network services?

I understand that engineering work takes time, but given the severity and the availability of a public exploit, users need more than general security recommendations.

A clear patch status and an estimated remediation timeline from the engineering team would be appreciated.

siyarbekir47 wrote: ↑Yesterday, 23:38

Thank you for your detailed follow-up. We completely understand your concern regarding the severity of CVE-2026-98432 and your need for clear updates.

Our security team is currently conducting an internal evaluation and discussion to assess the exact impact and determine the appropriate action plan.

Until this final assessment is completed, we are unable to confirm specific patch statuses or release timelines. In the meantime, if you need to maintain external access, we strongly recommend connecting via an encrypted tunnel (such as Tailscale or OpenVPN) or placing your services behind a reverse proxy with strict access controls, rather than exposing raw ports directly to the public internet.

We are actively following up on this internally and will post an update in this thread as soon as a formal plan is finalized. Thank you for your patience and understanding!