Synology MailPlus Server Vulnerabilities Allow Attackers to Trigger DoS Attacks

Cybersecuritynews •Abinaya • June 30, 2026

Synology has released a critical security advisory addressing multiple vulnerabilities in its MailPlus Server package that could allow attackers to execute denial-of-service (DoS) attacks, access internal services, and read or modify arbitrary files. The vulnerabilities affect multiple versions of MailPlus Server running on DiskStation Manager (DSM), and users are strongly urged to update immediately, as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Synology MailPlus Server Expose Users to Attacks Synology has identified multiple critical vulnerabilities in its MailPlus Server that could allow attackers to execute denial-of-service (DoS) attacks, access internal services, and manipulate files. The vulnerabilities, including CVE-2025-15660 and CVE-2026-13136, have been rated critical with a CVSS score of 10. Users running MailPlus Server versions 4.0.1-21663 on DSM 7.2.1, 7.2.2, and 7.3 are particularly at risk. The third vulnerability, CVE-2026-13135, is classified as medium and allows access to internal services. Synology has released patches to address these vulnerabilities, and users are urged to update immediately. No ongoing attacks have been reported at this time. 2 sources 72

Extracted Entities

Synology MailPlus Server Vulnerabilities Allow Attackers to Trigger DoS Attacks

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (2)