Back Cybersecuritynews

Synology DiskStation Manager Vulnerability Allow Remote Attackers to Execute Arbitrary Commands

Cybersecuritynews •Abinaya • March 26, 2026

A critical security advisory has been issued for a severe vulnerability in DiskStation Manager (DSM) that allows unauthenticated remote attackers to execute arbitrary commands. Given the widespread use of Synology network-attached storage (NAS) systems for enterprise backups and data management, network administrators are strongly urged to apply the available patches immediately. Tracked as CVE-2026-32746, the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Synology DSM Vulnerability Enables Remote Command Execution Synology has released an urgent security update for its DiskStation Manager (DSM) software to address a critical vulnerability, CVE-2026-32746, which could allow unauthenticated remote attackers to execute arbitrary commands on affected NAS devices. This vulnerability, tracked under security advisory Synology-SA-26:03, has a maximum CVSS v3 score of 9.8, indicating a severe risk to users. The flaw originates from a buffer overflow in the telnetd service of the GNU Inetutils package, affecting software versions up to 2.7. If exploited, attackers could deploy ransomware, steal sensitive data, or use compromised devices to attack other systems on the network. Synology recommends that administrators apply the latest firmware updates immediately and disable the Telnet service as a temporary workaround. While patches are available for the main DSM product line, some specialized systems are still awaiting fixes. The vulnerability was published on March 13, 2026, with the first proof of concept appearing on March 18, 2026. 3 sources 73

Extracted Entities

Synology DiskStation Manager Vulnerability Allow Remote Attackers to Execute Arbitrary Commands

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)