Loading vulnerability…
Unauthenticated Arbitrary File Read/Write in Synology DSM SCGI
CVE-2026-13684 is an improper output encoding or escaping vulnerability in the SCGI component of Synology DiskStation Manager (DSM). Crafted network requests allow unauthenticated remote attackers to read or write arbitrary files and cause denial of service without user interaction. Affected releases are DSM 7.2.1 before 7.2.1-69057-12, DSM 7.2.2 before 7.2.2-72806-9, DSM 7.3 before 7.3.2-86009-4, and DSM 7.4 before 7.4-90075. The vulnerability is rated Critical with a CVSS v3.1 score of 9.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises confidentiality through arbitrary file disclosure, integrity through arbitrary file creation or modification, and availability through denial of service. Attackers may expose sensitive NAS data or tamper with system configurations and hosted-service files. Direct arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
No vendor-provided workaround is available. Until patched, remove direct Internet exposure of DSM management services and restrict access to trusted networks or authenticated VPN connections using firewall rules. Disable unnecessary port forwarding and UPnP mappings, or isolate devices that cannot be patched. Monitor for unexpected file access, bulk modifications, suspicious sessions, and unauthorized configuration changes. Strong passwords and multifactor authentication do not prevent this unauthenticated exploit.
Patch, then assume compromise.
Upgrade to DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075, or a later fixed release in the corresponding branch. Enable automatic security updates and verify the installed build. Investigate potentially exposed devices for prior compromise; installing the update does not remove an existing intrusion or restore damaged data.
No validated public exploits yet. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.