Advisory
21 September 2026
Background
CVSSv3 Score: Base 9.8 Critical
Synology has released security updates addressing multiple critical vulnerabilities in DiskStation Manager (DSM). CVE-2026-13684 affects the DSM SCGI component, while CVE-2026-13639 affects login logic. Both vulnerabilities can be exploited remotely without authentication and may allow attackers to read or write arbitrary files or cause a denial-of-service condition. Synology has rated both vulnerabilities as Critical with a CVSS score of 9.8.
CVE-2026-13684 is an improper encoding or escaping of output vulnerability in the DSM SCGI component. Successful exploitation may allow a remote, unauthenticated attacker to read or write arbitrary files and disrupt system availability.
CVE-2026-13639 is an insufficient entropy vulnerability in DSM login logic. This weakness may allow remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Both vulnerabilities share the following characteristics:
- Network-exploitable
- Low attack complexity
- No privileges required
- No user interaction required
Impact
Successful exploitation could allow an attacker to:
- Read sensitive files stored on the NAS.
- Create, modify, or overwrite files.
- Tamper with system configurations or hosted services.
- Cause service disruption or denial-of-service conditions.
- Compromise the confidentiality, integrity, and availability of data managed by the DSM system.
Because these vulnerabilities can be exploited remotely without authentication, internet-exposed NAS devices should be treated as high-priority remediation targets.
Affected Products
| DSM Branch | Affected Versions | Fixed Versions |
|---|---|---|
| DSM 7.4 | Earlier than 7.4-90075 | 7.4-90075 or later |
| DSM 7.3 | Earlier than 7.3.2-86009-4 | 7.3.2-86009-4 or later |
| DSM 7.2.2 | Earlier than 7.2.2-72806-9 | 77.2.2-72806-9 or later |
| DSM 7.2.1 | Earlier than 7.2.1-69057-12 | 7.2.1-69057-12 or later |
Recommendations
- Disable unnecessary port forwarding and Universal Plug and Play (UPnP) on routers and NAS devices.
- Update DSM to the applicable fixed release listed above through Control Panel → Update & Restore → DSM Update or use Synology’s official update process.
- Reset administrator and other privilege account passwords, revoke active sessions, and review multi-factor authentication (MFA) settings.
References
