1.0 Introduction
Recently, Synology released a security update to address multiple
vulnerabilities (CVE-2026-13639, CVE-2026-13684, CVE-2026-13673, and
CVE-2026-6205) affecting Synology DiskStation Manager (DSM).
2.0 Impact
Due to insufficient entropy in the login logic, improper encoding or
escaping of output in SCGI, incorrect permission assignment for critical
resource in the LDAP API and external control of file name or path in the
Upload API, these vulnerabilities could allow remote attackers to read or write
arbitrary files and conduct denial-of-service attacks against affected Synology
DiskStation Manager (DSM) systems.
3.0 Affected
Versions
|
Product |
Fixed
Released Availability |
|
DSM 7.4 |
Upgrade to
7.4-90075 or above |
|
DSM 7.3 |
Upgrade to 7.3.2-86009-4
or above |
|
DSM 7.2.2 |
Upgrade to 7.2.2-72806-9
or above |
|
DSM 7.2.1 |
Upgrade to 7.2.1-69057-12
or above |
4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators
to review the following advisories and apply the necessary updates:
Kindly, please refer to the URL below: https://www.synology.com/en-global/security/advisory/Synology_SA_26_13
Generally, we advise users to be updated with the latest
security announcements by the vendor and follow best practice security policies
to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident
Response Centre through the following channels:
E-mail:
cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://www.cve.org/CVERecord?id=CVE-2026-13684
- https://www.cve.org/CVERecord?id=CVE-2026-13639
- https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-127/
- https://www.synology.com/en-global/security/advisory/Synology_SA_26_13