Synology DSM flaws allow file access and disruption

What happened

Synology has issued fixes for security flaws in DiskStation Manager (DSM), its device management software. Think of DSM as a building's front desk: weaknesses in how it checks access or handles requests can put the files behind that desk at risk. The advisory covers DSM 7.2.1, DSM 7.2.2, DSM 7.3, and DSM 7.4.

The vulnerabilities affect login logic, an LDAP API, SCGI, and an Upload API. Depending on the flaw, a remote attacker could read files, write files, or interrupt service. The LDAP API and Upload API vulnerabilities explicitly require an authenticated user, meaning someone who has already signed in. The login and SCGI descriptions identify remote attackers without specifying an authentication requirement.

Synology's advisory identifies the affected releases and their fixes, while the National Vulnerability Database (NVD) supplies severity scores and weakness classifications. NVD published the entries on 2026-09-18. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-30.

Technical details

CVE-2026-13639 affects DSM's login logic and is classified as CWE-331, Insufficient Entropy. Entropy describes unpredictability; insufficient entropy means a security-related value or process lacks enough randomness. The description does not identify the particular value or implementation mistake. It says a remote attacker could access file contents, make file changes, and cause denial of service, meaning a disruption that prevents normal use. Its CVSS 3.1 score is 9.8, rated CRITICAL. The Common Vulnerability Scoring System (CVSS) expresses technical severity; it does not establish that exploitation has occurred.

CVE-2026-13673 concerns permissions in the LDAP API. LDAP stands for Lightweight Directory Access Protocol, and an API is an interface software uses to exchange requests. The assigned classification is CWE-732, Incorrect Permission Assignment for Critical Resource: a sensitive resource has permissions that do not properly limit access. A remote authenticated user could read or modify files and disrupt service. Its CVSS 3.1 score is 8.8, rated HIGH. The description does not specify the account privileges needed beyond authentication.

CVE-2026-13684 affects SCGI, an interface used to pass requests between software components. It is classified as CWE-116, Improper Encoding or Escaping of Output. Encoding and escaping help ensure that output is interpreted as intended; the identified weakness concerns that handling. The description does not explain the exact request or output involved, but it identifies possible file reading, file writing, and service disruption by remote attackers. Its CVSS 3.1 score is 9.8, rated CRITICAL.

CVE-2026-6205 affects the Upload API and is classified as CWE-73, External Control of File Name or Path. This means externally controlled information can influence the name or location used for a file operation. A remote authenticated user could write files to arbitrary locations and disrupt service. Its CVSS 3.1 score is 8.1, rated HIGH. Unlike the other descriptions, this entry does not identify arbitrary file reading as an impact. Across these vulnerabilities, the scores describe severity, while the authentication requirements help explain the access an attacker would need.

Who is affected

Everyday users

For everyday users, the practical concerns are file privacy, file integrity, and availability. Reading files can expose their contents. Writing files can change stored information. Denial of service can prevent normal access to the device or its services. These are possible consequences of the vulnerabilities, not evidence that a particular device has been compromised.

The useful check is the complete installed DSM version. A device labeled DSM 7.2.1 or DSM 7.2.2 still needs its full build and update suffix compared with the advisory. DSM 7.3 and DSM 7.4 also have specific fixed releases. The branch name alone does not establish whether the fixes are installed.

Developers

Developers maintaining software that interacts with DSM should distinguish the affected interfaces and their access requirements. The LDAP API and Upload API issues involve authenticated users, so an integration's ability to sign in matters when reviewing exposure. Authentication is a prerequisite for those flaws, rather than proof that the underlying file operations are safe.

The weakness classifications point to different failure areas: randomness in login logic, resource permissions, output handling, and control over file destinations. They do not supply enough implementation detail to reconstruct an exploit or prescribe a code-level workaround. For deployed DSM systems, the concrete remediation is the fixed DSM release identified by Synology.

Server and IT admins

Server and IT administrators should inventory the full DSM release on each managed device and compare it with the matching branch below. All of the listed vulnerabilities share the same fixed-version threshold within each branch, making the installed release the central remediation check.

The CRITICAL and HIGH ratings support giving these updates priority in maintenance planning. As of the catalog check, none of these CVEs is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. That catalog status does not change which DSM versions the vendor identifies as affected.

What to do now

1. Identify each device's full installed DSM version and match it to the corresponding product branch in Synology's advisory.
2. For DSM 7.2.1 earlier than 7.2.1-69057-12, update to 7.2.1-69057-12 and later.
3. For DSM 7.2.2 earlier than 7.2.2-72806-9, update to 7.2.2-72806-9 and later.
4. For DSM 7.3 earlier than 7.3.2-86009-4, update to 7.3.2-86009-4 and later.
5. For DSM 7.4 earlier than 7.4-90075, update to 7.4-90075 and later.
6. Follow the update steps in the vendor's advisory for the affected device.
7. After updating, confirm the installed version and record the result for each device so unresolved systems remain visible.

If you can't update yet

• If an update must wait, check the vendor advisory for guidance on restricting access to affected DSM services and reducing their internet exposure.
• Check the vendor advisory before disabling an affected feature; use that approach only if the vendor recommends it for these vulnerabilities.

How to confirm the fix

• Read the full installed DSM version after the update completes, including its build and update suffix, and compare it with the fixed release for that branch.
• Confirm that each device meets its branch's threshold: 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075, and later.
• Confirm normal access to the device and the services you use. A successful connection checks availability; the installed version establishes whether the advisory's fixed-release requirement has been met.

NVD scores and CISA KEV status

As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 16 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Synology advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_26_13
• NVD: CVE-2026-13639
• NVD: CVE-2026-13673
• NVD: CVE-2026-13684
• NVD: CVE-2026-6205
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 30, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.