Loading story…
Synology disclosed two CVSS 9.8 vulnerabilities in DiskStation Manager (DSM), CVE-2026-13639 and CVE-2026-13684, that allow network-based, unauthenticated attackers to read or write arbitrary files on affected NAS devices. The flaws—a weak login-session token generation issue and improper encoding/escaping in the SCGI component—can also enable file deletion and denial of service, creating a material risk of full NAS compromise and ransomware abuse.
Affected DSM branches include 7.2.1, 7.2.2, 7.3, and 7.4. Synology issued fixes in DSM 7.4-90075, 7.3-86009-4, 7.2.2-72806-9, and 7.2.1-69057-12; no workaround is available. Administrators should apply the applicable update immediately and disconnect unpatchable systems or restrict exposure of their management interfaces. No public exploit or CISA KEV listing was reported at disclosure.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Synology published advisory SA-26:13 for CVE-2026-13639 and CVE-2026-13684, two CVSS 9.8 vulnerabilities affecting DSM login-session handling and the SCGI component. The flaws permit unauthenticated network attackers to read or write arbitrary files and cause denial of service; Synology issued fixed DSM builds for affected 7.2.1, 7.2.2, 7.3, and 7.4 releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Synology disclosed three vulnerabilities in **MailPlus Server** for DiskStation Manager (**DSM**), including two **Critical** flaws that can let attackers read or write arbitrary files and trigger denial-of-service conditions. The most severe issue, `CVE-2026-13136`, carries a **CVSS 10.0** rating and can be exploited remotely without authentication, while `CVE-2025-15660` can be abused by an adjacent attacker for similar file access and service disruption. A third flaw, `CVE-2026-13135`, is rated Moderate and can allow remote attackers to access internal services. The advisory affects MailPlus Server deployments on **DSM 7.3, 7.2.2, and 7.2.1**. Synology said there is **no mitigation or workaround** other than upgrading to the fixed releases, directing customers to update to **4.0.1-31663** or **4.0.1-21663** depending on platform version. Organizations using Synology MailPlus Server are being urged to patch immediately because the exposed attack paths include unauthenticated remote exploitation and arbitrary file operations.
Jul 12, 2026
Synology disclosed **`CVE-2024-10441`**, a critical improper encoding or escaping of output flaw in the **system plugin daemon** affecting multiple products, including **BeeStation Manager**, **DiskStation Manager (DSM)**, and **Unified Controller/DSMUC**. The vulnerability can let a remote attacker execute arbitrary code **without user interaction**, and public advisories warned that successful exploitation could also enable unauthorized file access and modification, raising the risk of full device compromise and data exposure. Synology issued patched releases across affected **BeeStation OS**, **DSM**, and **DSMUC** branches, while national CERT guidance urged organizations to update exposed appliances immediately. Additional recommended mitigations included segmenting Synology devices from untrusted networks, restricting access with firewalls, monitoring for suspicious activity, and conducting regular vulnerability scans to identify unpatched systems.
Aug 1, 2026
Synology released a security update for its **SSL VPN Client** to fix two Important vulnerabilities, `CVE-2021-47960` and `CVE-2021-47961`, affecting versions before `1.4.5-0684`. The company said a remote attacker could exploit the flaws if a user is lured to a crafted web page while the VPN client is running. One issue stems from improper access controls on a local loopback HTTP service, allowing access to sensitive files in the installation directory, including configuration files, certificates, and logs. The second flaw involves insecure plaintext storage of the client PIN, which can let an attacker read or manipulate PIN data, alter VPN configuration, and potentially intercept later VPN traffic. Synology said no workaround is available and urged customers to upgrade immediately to **SSL VPN Client 1.4.5-0684 or later**. The vulnerabilities were reported by security researcher **Laurent Sibilla**.
Jun 29, 2026