Loading vulnerability…
Insufficient Entropy in Synology DSM Login Logic
CVE-2026-13639 is an insufficient-entropy vulnerability in the login logic of Synology DiskStation Manager (DSM). Inadequate randomness in values used by the login mechanism allows unauthenticated remote attackers to read or write arbitrary files and cause denial of service. Affected releases include DSM 7.2.1 before 7.2.1-69057-12, DSM 7.2.2 before 7.2.2-72806-9, DSM 7.3 before 7.3.2-86009-4, and DSM 7.4 before 7.4-90075. The vulnerability is rated Critical with a CVSS v3.1 score of 9.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of affected DSM systems. Attackers can access sensitive files, create or overwrite arbitrary files, manipulate stored data or system configurations, and disrupt NAS services through denial-of-service attacks.
If you can’t patch tonight, do this now.
No vendor-provided workaround is available. Until patched, remove direct Internet exposure of DSM management services, disable unnecessary port forwarding and UPnP mappings, and restrict access through firewall rules to trusted networks or an authenticated VPN. Isolate affected appliances if access cannot be adequately restricted. Monitor for suspicious sessions, unauthorized accounts, unexpected file modifications, and scheduled scripts. Maintain independent offline or immutable backups. Strong passwords and multifactor authentication do not prevent exploitation of this unauthenticated vulnerability.
Patch, then assume compromise.
Upgrade to DSM 7.2.1-69057-12, DSM 7.2.2-72806-9, DSM 7.3.2-86009-4, or DSM 7.4-90075, or a later fixed release in the corresponding branch. These fixes were released on September 18, 2026, under Synology advisory SA-26:13. Enable automatic updates where appropriate. Investigate potentially exposed systems for prior compromise; installing the update does not remove existing attacker access or restore damaged files.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.