Multiple Critical Vulnerabilities in Synology DiskStation Manager (DSM) CVE-2026-13684 & CVE-2026-13639
Base 9.8 Critical
BACKGROUND
Synology has released security updates addressing multiple critical vulnerabilities in DiskStation Manager (DSM). CVE-2026-13684 affects the DSM SCGI component, while CVE-2026-13639 affects login logic. Both vulnerabilities can be exploited remotely without authentication and may allow attackers to read or write arbitrary files or cause a denial-of-service condition. Synology has rated both vulnerabilities as Critical with a CVSS score of 9.8.
CVE-2026-13684 is an improper encoding or escaping of output vulnerability in the DSM SCGI component. Successful exploitation may allow a remote, unauthenticated attacker to read or write arbitrary files and disrupt system availability.
CVE-2026-13639 is an insufficient entropy vulnerability in DSM login logic. This weakness may allow remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Both vulnerabilities share the following characteristics:
- Network-exploitable
- Low attack complexity
- No privileges required
- No user interaction required
IMPACT
Successful exploitation could allow an attacker to:
- Read sensitive files stored on the NAS.
- Create, modify, or overwrite files.
- Tamper with system configurations or hosted services.
- Cause service disruption or denial-of-service conditions.
Compromise the confidentiality, integrity, and availability of data managed by the DSM system.
Because these vulnerabilities can be exploited remotely without authentication, internet-exposed NAS devices should be treated as high-priority remediation targets.
AFFECTED PRODUCTS
| DSM Branch | Affected Versions | Fixed Versions | |
| 1 | DSM 7.4 | Earlier than 7.4-90075 | 7.4-90075 or later |
| 2 | DSM 7.3 | Earlier than 7.3.2-86009-4 | 7.3.2-86009-4 or later |
| 3 | DSM 7.2.2 | Earlier than 7.2.2-72806-9 | 7.2.2-72806-9 or later |
| 4 | DSM 7.2.1 | Earlier than 7.2.1-69057-12 | 7.2.1-69057-12 or later |
RECOMMENDATIONS
- Disable unnecessary port forwarding and Universal Plug and Play (UPnP) on routers and NAS devices.
- Update DSM to the applicable fixed release listed above through Control Panel → Update & Restore → DSM Update or use Synology’s official update process.
- Reset administrator and other privilege account passwords, revoke active sessions, and review multi-factor authentication (MFA) settings.
REFERENCES
https://www.synology.com/en-global/security/advisory/Synology_SA_26_13
https://mallory.ai/vulnerabilities/CVE-2026-13684
https://www.ionix.io/threat-center/cve-2026-13639/