Synology has patched a critical insufficient-entropy vulnerability in DiskStation Manager login logic that lets unauthenticated remote attackers read or write arbitrary files and trigger denial-of-service conditions.
What Is It
CVE-2026-13639 is an insufficient entropy vulnerability (CWE-331) in the login logic of Synology DiskStation Manager (DSM). Weak randomness in an authentication path means values that should be unpredictable are not, and per Synology's advisory the flaw allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks against affected NAS appliances.
The CVE was published on 2026-09-18 by Synology's own CNA ([email protected]) and currently carries a vulnerability status of "Received" in NVD, meaning NVD enrichment and CPE assignment are still pending.
Why It Matters
Synology assigned a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Every exploitability metric is at its worst setting: network-reachable, low attack complexity, no privileges required, and no user interaction. That yields the maximum exploitability subscore of 3.9, paired with an impact subscore of 5.9; high across confidentiality, integrity, and availability. In practical terms, anything that can reach the DSM login interface can attempt this, and success means arbitrary file read, arbitrary file write, or knocking the device offline.
CVE-2026-13639 does not appear in CISA's Known Exploited Vulnerabilities catalog as of publication, so there is no KEV-mandated remediation deadline. KEV listing lags real-world activity and covers only exploitation that has been publicly confirmed, so absence from the catalog should be read as no confirmed public reporting rather than as evidence that the flaw is not being exploited.
What's Vulnerable
Synology DiskStation Manager (DSM), with a default status of affected, across four release branches:
| Branch | Affected below |
|---|---|
| 7.4 | 7.4-90075 |
| 7.3.2 | 7.3.2-86009-4 |
| 7.2.2 | 7.2.2-72806-9 |
| 7.2.1 | 7.2.1-69057-12 |
Versions below 7.2.1 are listed with a status of unknown: Synology has not confirmed them as either affected or unaffected. Treat older builds as unresolved rather than safe. No CPE strings have been published yet.
Patch Status
Fixed builds are available. Upgrade DSM to at least the corresponding build for your branch: 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075. Because the flaw is pre-authentication and network-facing, internet-exposed DSM instances should be prioritized. Synology advisory SA_26_13 lists no workaround or interim mitigation, so upgrading is the only vendor-provided remediation; where patching cannot happen immediately, restricting network reachability of the DSM login interface is the practical fallback, though it reduces rather than removes exposure.
Sources
- Synology Security Advisory SA_26_13; https://www.synology.com/en-global/security/advisory/Synology_SA_26_13
- NVD, CVE-2026-13639, https://nvd.nist.gov/vuln/detail/CVE-2026-13639
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog