⚠ CVSS 9.8 CriticalUpdated 2026-10-31
CVE-2026-13639 Synology DSM Vulnerability — What It Is and the Exact Fix
An unauthenticated remote attacker can read and write arbitrary files, or cause denial of service. Qihoo 360 says the October 2026 C3RB3R ransomware samples it analyzed used this flaw (with CVE-2026-13684) as the entry point. No workaround exists — only updating protects you.
| Item | Detail |
|---|---|
| CVE | CVE-2026-13639 |
| Severity | 9.8 Critical |
| Affected | Synology DSM (multiple branches) |
| Status | disclosed 18 September 2026 (Synology-SA-26:13) |
| Fixed in | DSM 7.4-90075 · 7.3.2-86009-4 · 7.2.2-72806-9 · 7.2.1-69057-12 or later |
| Workaround | None listed — update, and keep the admin interface off the open internet |
Check whether you're patched
Open Control Panel → Info Center and read the DSM build number (e.g. 7.2.1-69057 Update 5). Compare it against the fixed builds above — if yours is lower, update immediately via Update & Restore, then enable automatic updates so this never silently repeats. If your model is end-of-life and cannot reach the fixed branch, isolate the NAS from the internet (firewall, no port forwards, no DMZ) — see the hardening checklist.
Context
This flaw is part of the October 2026 C3RB3R ransomware campaign against Synology NAS devices. The full incident page has the timeline, the encryption details, and recovery steps.
FAQ
Is CVE-2026-13639 being exploited right now?
Yes — it is one of the flaws cited in the October 2026 C3RB3R ransomware campaign against Synology NAS devices. Devices on patched builds are protected; devices below the fixed builds and exposed to the internet are at real risk.
How do I check my DSM build number?
Control Panel → Info Center shows the DSM version and build (for example 7.2.1-69057 Update 5). Compare against the fixed-build table on this page. Note: 7.2.1-69057 'Update 5' is LOWER than the fixed 7.2.1-69057-12 — the suffix matters.
I can't update (old model / DSM 6). What now?
Models end-of-life on DSM 6.x have no patch for these flaws. The safe posture is full isolation: remove port forwards, block WAN access to the admin UI, use VPN-only access if needed, and keep an off-NAS backup. See the hardening checklist.