Loading story…
Synology released a security update for its SSL VPN Client to fix two Important vulnerabilities, CVE-2021-47960 and CVE-2021-47961, affecting versions before 1.4.5-0684. The company said a remote attacker could exploit the flaws if a user is lured to a crafted web page while the VPN client is running. One issue stems from improper access controls on a local loopback HTTP service, allowing access to sensitive files in the installation directory, including configuration files, certificates, and logs.
The second flaw involves insecure plaintext storage of the client PIN, which can let an attacker read or manipulate PIN data, alter VPN configuration, and potentially intercept later VPN traffic. Synology said no workaround is available and urged customers to upgrade immediately to SSL VPN Client 1.4.5-0684 or later. The vulnerabilities were reported by security researcher Laurent Sibilla.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A follow-up report described how the patched flaws could expose sensitive local files, reveal or alter PIN data, and potentially enable later VPN traffic interception through rogue configuration changes. The report reiterated that exploitation required user interaction with a malicious web page.
Synology disclosed SA-26-05 on 2026-04-10 and released an update to fix CVE-2021-47960 and CVE-2021-47961 in SSL VPN Client. The company said no workaround was available and instructed customers to upgrade to version 1.4.5-0684 or later.
Security researcher Laurent Sibilla discovered and reported two vulnerabilities in Synology SSL VPN Client, later assigned CVE-2021-47960 and CVE-2021-47961. The issues affected versions before 1.4.5-0684 and could be exploited if a user was lured to a crafted web page while the client was running.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
coalitioninc.com
Open sourcecybersecuritynews.com
Open sourcesynology.com
Open sourcecybersecuritydive.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Synology disclosed three vulnerabilities in **MailPlus Server** for DiskStation Manager (**DSM**), including two **Critical** flaws that can let attackers read or write arbitrary files and trigger denial-of-service conditions. The most severe issue, `CVE-2026-13136`, carries a **CVSS 10.0** rating and can be exploited remotely without authentication, while `CVE-2025-15660` can be abused by an adjacent attacker for similar file access and service disruption. A third flaw, `CVE-2026-13135`, is rated Moderate and can allow remote attackers to access internal services. The advisory affects MailPlus Server deployments on **DSM 7.3, 7.2.2, and 7.2.1**. Synology said there is **no mitigation or workaround** other than upgrading to the fixed releases, directing customers to update to **4.0.1-31663** or **4.0.1-21663** depending on platform version. Organizations using Synology MailPlus Server are being urged to patch immediately because the exposed attack paths include unauthenticated remote exploitation and arbitrary file operations.
Jul 12, 2026
Synology addressed a critical remote code execution vulnerability (CVE-2025-12686) in its BeeStation product after the flaw was publicly demonstrated at the Pwn2Own Ireland 2025 competition. The vulnerability, which received a CVSS score of 9.8, stems from improper buffer size checks that allow remote attackers to execute arbitrary code on affected devices. Synology has released patches for all versions of BeeStation OS, urging users to upgrade to version 1.3.2-65648 or later to mitigate the risk. The flaw was one of several zero-days showcased at Pwn2Own Ireland 2025, where researchers were awarded over $1 million for discovering 73 unique vulnerabilities across a range of consumer and enterprise devices. The event highlighted the ongoing risks posed by zero-day vulnerabilities in widely used storage and smart home products. Other vendors, including QNAP, also issued patches for vulnerabilities revealed during the competition.
Jun 29, 2026
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026