How severe is CVE-2022-36326?

CVE-2022-36326 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over network with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2022-36326 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-36326?

CVE-2022-36326 primarily affects Westerndigital My Cloud Os 5. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-36326?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-36326 published?

CVE-2022-36326 was published on 2023-05-18 and last updated on 2026-06-17.

CVE-2022-36326

CVE-2022-36326 is a medium-severity vulnerability in Westerndigital My Cloud Os 5 with a CVSS 3.x base score of 4.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-400.

Key facts

Severity: Medium (CVSS 3.x base score 4.4)
EPSS exploit prediction: 1% (43rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-400
Affected product: Westerndigital My Cloud Os 5
Published: 2023-05-18
Last modified: 2026-06-17

Description

An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires the attacker to already have root privileges in order to exploit this vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.

Frequently asked questions

What is CVE-2022-36326?: An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires the attacker to already have root privileges in order to exploit this vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.
How severe is CVE-2022-36326?: CVE-2022-36326 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over network with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2022-36326 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-36326?: CVE-2022-36326 primarily affects Westerndigital My Cloud Os 5. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-36326?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-36326 published?: CVE-2022-36326 was published on 2023-05-18 and last updated on 2026-06-17.

References

Affected products (4)

cpe:2.3:o:westerndigital:my_cloud_os_5:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Westerndigital My Cloud Os 5

CVE-2020-29563 — Critical (CVSS 9.8): An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass…
CVE-2020-28971 — Critical (CVSS 9.8): An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass…
CVE-2020-28970 — Critical (CVSS 9.8): An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass…
CVE-2020-28940 — Critical (CVSS 9.8): On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass…
CVE-2022-36328 — Medium (CVSS 5.8): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an…
CVE-2022-36327 — Medium (CVSS 5.8): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an…

All CVEs affecting Westerndigital My Cloud Os 5 →

Other CWE-400 (Uncontrolled Resource Consumption) vulnerabilities

CVE-2026-46775 — Critical (CVSS 9.9): Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0.…
CVE-2025-61303 — Critical (CVSS 9.8): Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a…
CVE-2025-43193 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
CVE-2025-24269 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
CVE-2025-24264 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4,…
CVE-2025-24260 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5,…

Browse all CWE-400 (Uncontrolled Resource Consumption) vulnerabilities →