QNAP NAS End of Life: Four Models Reach EOL on December 31, 2026
Four QNAP NAS models reach the end of QNAP's security updates on December 31, 2026: the ES1686dc and ES2486dc dual-controller enterprise units, the TDS-16489U R2 dual-processor server and the TS-2888X. That is the date QNAP prints for each of them in the "Technical Support and Security Updates" column of its Product Support Status page, and QNAP's own legend defines a date in that column as the "end date of limited technical support and security updates". Three of the four are already marked EOL for Product Availability, with hardware repair Discontinued; the ES2486dc is still Active on every other column. The date is the same for all four, and QNAP lists nothing after it.
QNAP's four columns, in QNAP's words
QNAP does not publish a single end-of-life date per model. Its Product Support Status page prints four columns for every NAS and expansion unit, each with its own legend, and the FAQ article QNAP links from the page ("How do I check the support status of my QNAP product?", last modified September 2025) describes three phases: Supported, End of Support (EOS) and End of Life (EOL). The four columns, with QNAP's legend text:
- Product Availability. Active or EOL. QNAP's note for EOL products: "These products are not supported by QNAP's future OS updates or services." The FAQ adds that a product listed as End of Life "will not receive further firmware updates or technical support from QNAP."
- Hardware Repair or Replacement. Full ("Repairs and replacements are offered"), Limited (some components still available from QNAP's accessories store) or Discontinued ("The product is no longer supported").
- OS and Application Updates and Maintenance. Full ("The products continuously receive the latest OS updates and software features"), or a month (the end date of OS updates) together with the last QTS or QES version the model can run.
- Technical Support and Security Updates. Active ("The products receive complete technical support and security patches from our expert engineers"), or a date: "End date of limited technical support and security updates." QNAP's note under this column: "The latest version contains fixes for all security issues. Due to architectural and system changes that require the latest version of QTS, not all security issues are addressed in earlier versions."
Our data serves the Technical Support and Security Updates date as each model's eol date, because it is the last date on which QNAP commits to any security fix for the hardware. Where QNAP prints a full day, as it does for these four models, we carry the day; where it prints only a month, we carry the last day of that month. Product Availability and hardware repair are carried alongside as vendor fields, which is why a model can be EOL for availability years before its security updates end, and, as the ES2486dc shows, Active for availability while its security-update date is already fixed.
The four models, as QNAP lists them
Read on October 7, 2026 from the Hardware tab of QNAP's page, column names as QNAP prints them. Each model links to its live status page here.
| Model | Product Availability | Hardware Repair or Replacement | OS and Application Updates | Technical Support and Security Updates | Successor model |
|---|---|---|---|---|---|
| ES1686dc | EOL | Discontinued | Full | December 31, 2026 | ES1686dc R2 |
| ES2486dc | Active | Full | Full | December 31, 2026 | None listed |
| TDS-16489U R2 | EOL | Discontinued | Full | December 31, 2026 | None listed |
| TS-2888X | EOL | Discontinued | Full | December 31, 2026 | None listed |
Every value in the table matches QNAP's page as read. All four still show Full under OS and Application Updates and Maintenance, so QNAP is still shipping operating system updates to them today; the security-update end date is the one that is fixed.
Key dates
- December 31, 2023: Technical Support and Security Updates ended for the TDS-16489U, the model the TDS-16489U R2 replaced.
- December 31, 2025: the most recent QNAP wave; the TS-1232XU, TS-1677X, TS-883XU and others reached their Technical Support and Security Updates date on that day.
- December 31, 2026: ES1686dc, ES2486dc, TDS-16489U R2 and TS-2888X. This page.
- December 31, 2027: the next wave, which includes the TS-h686, TS-h886, TVS-h1288X, TVS-h1688X and the TS-x53D and TS-x31K families.
- December 31, 2028: the TS-1635, the latest dated model on QNAP's page as read.
QNAP's dated models mostly fall on December 31 of a year (one older group ended in October 2022), so the practical question for any QNAP fleet is which year each model belongs to. Our QNAP NAS page lists every model with its column values; models QNAP marks EOL with no published security-update day are served as end of life with no date.
Why the date matters more for a QNAP NAS than for most storage
CISA's Known Exploited Vulnerabilities catalog credits 10 entries to QNAP's NAS line as of catalog version 2026.10.04, every one of them added during 2022. CISA files them under three product names, and we join them to this product because QTS is the operating system the appliances run and Photo Station is a QTS application:
- QNAP Network Attached Storage (NAS): CVE-2018-19943, CVE-2018-19949 and CVE-2018-19953 (File Station), CVE-2020-2509 (command injection) and CVE-2021-28799 (improper authorization, the QLocker ransomware wave).
- QTS: CVE-2019-7193 (improper input validation).
- Photo Station: CVE-2019-7192, CVE-2019-7194, CVE-2019-7195 and CVE-2022-27593 (externally controlled reference, the DeadBolt ransomware wave).
Nine of the ten carry CISA's known-ransomware-use flag; CVE-2020-2509 is the exception. None of the entries is scoped to a model, and CISA's required action for each is to apply mitigations per vendor instructions or discontinue use of the product. For a model past its Technical Support and Security Updates date there is no vendor instruction to apply: QNAP's page lists no further security updates for it, so the second half of CISA's sentence is the one that remains. QNAP's own note on the page points the same way: fixes land in the latest version, and "not all security issues are addressed in earlier versions."
The two ES models run QNAP's QES operating system rather than QTS, and QNAP's legend names both ("QTS/QES version: Last version of QTS/QES the NAS model can support"). The KEV entries above are filed against QTS, Photo Station and the NAS line generally; we do not assert which of the four models each entry reached. The point is narrower: this is a product family with a documented exploitation history, and the hardware on this page is about to leave the only window in which QNAP commits to fixing new findings.
What to do with the time you have
- Inventory by exact model name. QNAP's FAQ gives two ways to read it: the sticker on the bottom or rear of the unit, or Control Panel, System Status, System Information, Model Name in the web interface. "R2" and suffix letters matter; the TDS-16489U ended its security updates on December 31, 2023, the TDS-16489U R2 ends on December 31, 2026.
- Check the model on QNAP's page, not a reseller's. QNAP's Product Support Status page is the only place QNAP publishes the four columns, and QNAP encourages customers to visit it regularly. Our QNAP NAS page is read from the same source and re-checked at every build.
- Update to the newest firmware now, while updates still ship. All four models show Full for OS and Application Updates and Maintenance today. QNAP's note says the latest version contains fixes for all security issues; a unit left on an older QTS or QES build is outside that statement even before the date.
- Plan the replacement. QNAP names the ES1686dc R2 as the successor to the ES1686dc, and lists it as Active with Full hardware and OS support. The ES2486dc, TDS-16489U R2 and TS-2888X have no successor printed; QNAP's current enterprise and rackmount lines are on the same status page under Active.
- Keep the appliance off the internet. The QLocker and DeadBolt campaigns behind the KEV entries above reached units that were directly reachable. Disable UPnP port forwarding from the NAS, remove any router rule that exposes the QTS or QES web interface, and reach the unit over a VPN instead. After December 31, 2026 that isolation is the only control left for these four models, because QNAP no longer provides security updates for them.
- Treat the unit as an edge system in your inventory. A NAS holds backups and file shares, so an exposed one is both the target and the recovery path. Our Exploited and unpatchable feed tracks products that combine a KEV entry with the end of vendor fixes, and our EOL Checker and API cover the operating systems and databases around it.
Frequently Asked Questions
Which QNAP NAS models reach end of life on December 31, 2026?
Four models on QNAP's Product Support Status page carry December 31, 2026 in the Technical Support and Security Updates column: the ES1686dc and ES2486dc dual-controller enterprise units, the TDS-16489U R2 dual-processor server and the TS-2888X. QNAP's legend defines that column's date as the end date of limited technical support and security updates. After it, QNAP's page lists nothing further for the model.
Is the QNAP ES2486dc still supported?
Yes, for now. QNAP's page shows the ES2486dc with Product Availability Active, Hardware Repair or Replacement Full and OS and Application Updates and Maintenance Full, but its Technical Support and Security Updates column already carries an end date, December 31, 2026. It is the only one of the four models still marked Active; the ES1686dc, TDS-16489U R2 and TS-2888X are marked EOL with hardware repair Discontinued, and all four share the same security-update end date.
What does Technical Support and Security Updates mean on QNAP's status page?
It is one of four columns on QNAP's Product Support Status page. QNAP's legend reads: Active means the products receive complete technical support and security patches from QNAP's engineers; a date means the end date of limited technical support and security updates. The page adds that the latest version contains fixes for all security issues and that, because of architectural and system changes that require the latest version of QTS, not all security issues are addressed in earlier versions. We serve the column's date as the model's end-of-life date.
Why does end of life matter more for a QNAP NAS than for most storage?
Because QNAP NAS appliances are already a documented ransomware target. CISA's Known Exploited Vulnerabilities catalog credits 10 entries to QNAP's NAS line, filed under QNAP Network Attached Storage, QTS and Photo Station, and 9 of the 10 are flagged as known to be used in ransomware campaigns. None of the entries is scoped to a model; QTS is the operating system across the TS and TDS models. Once a model passes its Technical Support and Security Updates date, QNAP's page lists no further security updates for it, so any later QTS vulnerability stays open on that hardware.
What replaces the QNAP ES1686dc, TDS-16489U R2 and TS-2888X?
QNAP names a successor for one of the four: the ES1686dc is succeeded by the ES1686dc R2, which QNAP lists as Active with Full hardware and OS support. The ES2486dc, TDS-16489U R2 and TS-2888X have no successor model printed on QNAP's page as of October 7, 2026. The TDS-16489U R2 was itself the successor to the TDS-16489U, whose Technical Support and Security Updates ended on December 31, 2023.
Related
- QNAP NAS — the live status page for every NAS and expansion model QNAP lists, with its EOL Risk Score
- Exploited and unpatchable — products with a CISA KEV entry and no remaining vendor fix
- DrayTek Vigor 2960 end of life — another small-office appliance with KEV history reaching the end of vendor fixes
- QNAP Product Support Status — the vendor page these dates were read from (Hardware tab)
- How we verify our dates — the rules every number on this site is held to