Dark Web Intelligence on X: " SYNOLOGY DSM CRITICAL

Back X

Dark Web Intelligence on X: " SYNOLOGY DSM CRITICAL

X • September 19, 2026

Share: View original

Dark Web Intelligence on X: "🚨 SYNOLOGY DSM CRITICAL: UNAUTH ARBITRARY FILE R/W (CVSS 9.8)

Synology published Synology-SA-26:13 for DiskStation Manager, rating the advisory Critical.

Two unauthenticated remote vulnerabilities are scored CVSS 9.8:

• CVE-2026-13684 — SCGI improper encoding/escaping; arbitrary file read/write and DoS

• CVE-2026-13639 — login insufficient entropy; arbitrary file read/write and DoS

Additional Important issues allow authenticated arbitrary file read/write (CVE-2026-13673) and arbitrary write (CVE-2026-6205).

Affected: DSM 7.4 / 7.3 / 7.2.2 / 7.2.1. Fixed builds listed in the advisory. No workaround — upgrade.

Official advisory:

#DDW #DarkWeb #Synology #DSM #CVE #CyberSecurity #ThreatIntelligence"

🚨 SYNOLOGY DSM CRITICAL: UNAUTH ARBITRARY FILE R/W (CVSS 9.8)

Synology published Synology-SA-26:13 for DiskStation Manager, rating the advisory Critical.

Two unauthenticated remote vulnerabilities are scored CVSS 9.8:

• CVE-2026-13684 — SCGI improper encoding/escaping; arbitrary file read/write and DoS

• CVE-2026-13639 — login insufficient entropy; arbitrary file read/write and DoS

Additional Important issues allow authenticated arbitrary file read/write (CVE-2026-13673) and arbitrary write (CVE-2026-6205).

Affected: DSM 7.4 / 7.3 / 7.2.2 / 7.2.1. Fixed builds listed in the advisory. No workaround — upgrade.

🚨 SYNOLOGY DSM CRITICAL: UNAUTH ARBITRARY FILE R/W (CVSS 9.8)

Synology published Synology-SA-26:13 for DiskStation Manager, rating the advisory Critical.

Two unauthenticated remote vulnerabilities are scored CVSS 9.8:

• CVE-2026-13684 — SCGI improper encoding/escaping; arbitrary file read/write and DoS

• CVE-2026-13639 — login insufficient entropy; arbitrary file read/write and DoS

Additional Important issues allow authenticated arbitrary file read/write (CVE-2026-13673) and arbitrary write (CVE-2026-6205).

Affected: DSM 7.4 / 7.3 / 7.2.2 / 7.2.1. Fixed builds listed in the advisory. No workaround — upgrade.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Synology DSM Expose NAS Devices to Remote Attacks Synology has issued an advisory detailing eight security vulnerabilities in its DiskStation Manager (DSM) software, with CVE-2026-13684 and CVE-2026-13639 classified as critical, both scoring 9.8 on the CVSS scale. These flaws allow remote attackers to read or write arbitrary files and conduct denial-of-service attacks. Other vulnerabilities require authenticated access to exploit, including CVE-2026-13673, which also poses significant risks. Administrators are urged to upgrade to the latest DSM versions to mitigate these risks. The vulnerabilities were disclosed on September 18, 2026, and affect multiple DSM versions, including 7.4, 7.3, and 7.2. Synology has not provided temporary workarounds, emphasizing the urgency of applying patches. The advisory warns that these vulnerabilities could attract ransomware actors due to their ease of exploitation. 4 sources 72

Extracted Entities

Companies (1)

CVEs (4)

CVE-2026-13639 CVE-2026-13673 CVE-2026-13684 CVE-2026-6205

Platforms (1)

DiskStation Manager