Critical Vulnerabilities in Synology DSM Expose NAS Devices to Remote Attacks

• •Two critical vulnerabilities (CVE-2026-13684, CVE-2026-13639) allow remote file access.
• •Affected DSM versions include 7.4, 7.3, and 7.2; urgent patching is required.
• •Exploitation could lead to data breaches and denial-of-service attacks.

Synology has issued an advisory detailing eight security vulnerabilities in its DiskStation Manager (DSM) software, with CVE-2026-13684 and CVE-2026-13639 classified as critical, both scoring 9.8 on the CVSS scale. These flaws allow remote attackers to read or write arbitrary files and conduct denial-of-service attacks. Other vulnerabilities require authenticated access to exploit, including CVE-2026-13673, which also poses significant risks. Administrators are urged to upgrade to the latest DSM versions to mitigate these risks. The vulnerabilities were disclosed on September 18, 2026, and affect multiple DSM versions, including 7.4, 7.3, and 7.2. Synology has not provided temporary workarounds, emphasizing the urgency of applying patches. The advisory warns that these vulnerabilities could attract ransomware actors due to their ease of exploitation.