CVE-2026-13639 – Synology DiskStation Manager (DSM)
“When the box that holds every file can be read, rewritten, or knocked offline by a stranger, storage stops being an asset and becomes the attack surface.”
Synology has released DiskStation Manager (DSM) updates that fix five vulnerabilities, two of them Critical. These flaws let attackers read or write arbitrary files on the NAS and cause denial-of-service, which puts stored data and file-service availability at risk. CVE-2026-13639 is an insufficient entropy flaw in the login logic, with a CVSS score of 9.8, Critical severity. CVE-2026-13684 is an output encoding flaw in SCGI, with a CVSS score of 9.8, Critical severity. Unauthenticated remote attackers can exploit both.
Three High-severity flaws complete the update. CVE-2026-13673 is an incorrect permission assignment in the LDAP API, with a CVSS score of 8.8, High severity. CVE-2026-6205 is a file path control flaw in the Upload API, with a CVSS score of 8.1, High severity. Authenticated remote users can exploit both. CVE-2026-40539 is an improper certificate validation flaw in the Email API that is open to man-in-the-middle attackers, with a CVSS score of 7.1, High severity. The fixes ship in DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-331