Loading story…
Synology disclosed three vulnerabilities in MailPlus Server for DiskStation Manager (DSM), including two Critical flaws that can let attackers read or write arbitrary files and trigger denial-of-service conditions. The most severe issue, CVE-2026-13136, carries a CVSS 10.0 rating and can be exploited remotely without authentication, while CVE-2025-15660 can be abused by an adjacent attacker for similar file access and service disruption. A third flaw, CVE-2026-13135, is rated Moderate and can allow remote attackers to access internal services.
The advisory affects MailPlus Server deployments on DSM 7.3, 7.2.2, and 7.2.1. Synology said there is no mitigation or workaround other than upgrading to the fixed releases, directing customers to update to 4.0.1-31663 or 4.0.1-21663 depending on platform version. Organizations using Synology MailPlus Server are being urged to patch immediately because the exposed attack paths include unauthenticated remote exploitation and arbitrary file operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On 2026-06-26, Synology released advisory SA-26-11 for Synology MailPlus Server on DSM, disclosing three vulnerabilities: CVE-2026-13136, CVE-2025-15660, and CVE-2026-13135. The company directed customers to upgrade to fixed releases 4.0.1-31663 or 4.0.1-21663 and said no mitigation is available aside from applying the updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesynology.com
Open sourcecwe.mitre.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Synology released a security update for its **SSL VPN Client** to fix two Important vulnerabilities, `CVE-2021-47960` and `CVE-2021-47961`, affecting versions before `1.4.5-0684`. The company said a remote attacker could exploit the flaws if a user is lured to a crafted web page while the VPN client is running. One issue stems from improper access controls on a local loopback HTTP service, allowing access to sensitive files in the installation directory, including configuration files, certificates, and logs. The second flaw involves insecure plaintext storage of the client PIN, which can let an attacker read or manipulate PIN data, alter VPN configuration, and potentially intercept later VPN traffic. Synology said no workaround is available and urged customers to upgrade immediately to **SSL VPN Client 1.4.5-0684 or later**. The vulnerabilities were reported by security researcher **Laurent Sibilla**.
Jun 29, 2026
Multiple severe vulnerabilities in **SmarterMail** exposed internet-facing mail servers to compromise, including `CVE-2025-52691`, an unauthenticated arbitrary file upload flaw that can lead to immediate remote code execution, and `CVE-2026-23760`, an authentication bypass tied to the password reset API. Public reporting said `CVE-2025-52691` affected **Build 9406 and earlier**, carried a **CVSS 10.0** rating, and allowed attackers with network access to place files in arbitrary server locations and execute code with the privileges of the SmarterMail service. Advisories from Censys highlighted both issues, while a public GitHub proof-of-concept for `CVE-2026-23760` increased the risk of opportunistic exploitation. SmarterTools reportedly fixed the file upload vulnerability in **Build 9413**, with later builds available afterward, and security reporting warned that successful compromise of a mail gateway could expose customer email, credentials, and connected backend systems. The flaws were described as especially dangerous for hosting providers and organizations running exposed SmarterMail instances because they enable unauthenticated access paths that can quickly escalate to full server compromise.
Jun 29, 2026
A critical vulnerability identified as CVE-2025-52691 has been discovered in SmarterMail, allowing unauthenticated attackers to upload arbitrary files to any location on the mail server. This flaw, rated with a CVSS score of 10, enables remote code execution, potentially giving attackers full control over affected servers. The vulnerability can be exploited without authentication, significantly increasing the risk of compromise for organizations running vulnerable versions of SmarterMail. Security advisories emphasize the severity of this issue, warning that successful exploitation could lead to the deployment of web shells or other malicious payloads, facilitating further attacks or persistent access. Organizations using SmarterMail are urged to apply available patches immediately and review server logs for signs of unauthorized file uploads or suspicious activity.
Jun 29, 2026