⚠ CVSS 9.8 CriticalUpdated 2026-10-31
CVE-2026-13684 Synology DSM Vulnerability — What It Is and the Exact Fix
Like its sibling CVE-2026-13639, this is an unauthenticated remote file read/write flaw with no listed mitigation. Both were patched the same day; both were reportedly used by C3RB3R roughly a month later — a textbook 1-day attack on unpatched devices.
| Item | Detail |
|---|---|
| CVE | CVE-2026-13684 |
| Severity | 9.8 Critical |
| Affected | Synology DSM (multiple branches) |
| Status | disclosed 18 September 2026 (Synology-SA-26:13) |
| Fixed in | DSM 7.4-90075 · 7.3.2-86009-4 · 7.2.2-72806-9 · 7.2.1-69057-12 or later |
| Workaround | None listed — update, and keep the admin interface off the open internet |
Check whether you're patched
Open Control Panel → Info Center and read the DSM build number (e.g. 7.2.1-69057 Update 5). Compare it against the fixed builds above — if yours is lower, update immediately via Update & Restore, then enable automatic updates so this never silently repeats. If your model is end-of-life and cannot reach the fixed branch, isolate the NAS from the internet (firewall, no port forwards, no DMZ) — see the hardening checklist.
Context
This flaw is part of the October 2026 C3RB3R ransomware campaign against Synology NAS devices. The full incident page has the timeline, the encryption details, and recovery steps.
FAQ
Is CVE-2026-13684 being exploited right now?
Yes — it is one of the flaws cited in the October 2026 C3RB3R ransomware campaign against Synology NAS devices. Devices on patched builds are protected; devices below the fixed builds and exposed to the internet are at real risk.
How do I check my DSM build number?
Control Panel → Info Center shows the DSM version and build (for example 7.2.1-69057 Update 5). Compare against the fixed-build table on this page. Note: 7.2.1-69057 'Update 5' is LOWER than the fixed 7.2.1-69057-12 — the suffix matters.
I can't update (old model / DSM 6). What now?
Models end-of-life on DSM 6.x have no patch for these flaws. The safe posture is full isolation: remove port forwards, block WAN access to the admin UI, use VPN-only access if needed, and keep an off-NAS backup. See the hardening checklist.