The short answer: The critical Synology DSM vulnerabilities disclosed on September 18, 2026, affect unpatched builds in DSM branches 7.2.1 through 7.4. Check the full build number, verify that you have a usable backup stored outside the NAS being updated, and install a fixed version. Restricting internet access reduces the risk but does not replace the update.
Two flaws enable unauthenticated attacks
Synology published a security advisory on September 18, 2026, covering eight vulnerabilities in DSM. Two of them, CVE-2026-13684 and CVE-2026-13639, have a base CVSS score of 9.8.
According to the Synology security advisory, both flaws can be exploited over a network without authentication or user interaction. The attacks have low technical complexity and may affect the system’s confidentiality, integrity, and availability.
Synology states that these vulnerabilities may allow attackers to read or write arbitrary files and cause a denial of service:
- CVE-2026-13684 is related to improper output handling in the SCGI interface,
- CVE-2026-13639 concerns insufficient entropy in the login logic.
In its advisory dated September 21, 2026, the French CERT-FR also lists remote code execution, SQL injection, and XSS among the possible consequences of the full set of eight vulnerabilities. Without further evidence, however, these effects cannot be attributed specifically to the two flaws rated CVSS 9.8.
The cited advisories do not state whether these vulnerabilities have already been actively exploited. The absence of such information is not a reason to delay the update: the vendor rates the issue as critical and provides no alternative mitigation.
Which DSM builds are vulnerable
Labels such as „DSM 7„ or „DSM 7.2" are not specific enough. The DSM branch and the complete build number determine whether an installation is vulnerable.
| DSM branch | Vulnerable installations | Earliest fixed build |
|---|---|---|
| DSM 7.2.1 | Earlier than 7.2.1-69057-12 | 7.2.1-69057-12 |
| DSM 7.2.2 | Earlier than 7.2.2-72806-9 | 7.2.2-72806-9 |
| DSM 7.3 | Earlier than 7.3.2-86009-4 | 7.3.2-86009-4 |
| DSM 7.4.x | Earlier than 7.4-90075 | 7.4-90075 |
The table is based on the fixed versions listed in Synology’s September 18, 2026 advisory. For each branch, the vendor recommends upgrading to the listed build „or above."
You can find the installed version after signing in to DSM, usually under Control Panel → Update & Restore. The menu name may vary depending on the interface language and version. Record the full version number before updating and check it again after the restart.
A „system is up to date" message is not sufficient evidence on its own. Compare the displayed build with the table. If DSM does not offer the update automatically, this does not mean that an older installation is secure.
What a CVSS score of 9.8 actually means
CVSS expresses the technical severity of a vulnerability, not the likelihood that your particular NAS will be attacked. The high scores assigned to both flaws result from a combination of serious characteristics:
- the attack can be carried out over a network,
- it does not require an authenticated account,
- it requires no click or other user interaction,
- its technical complexity is low,
- the potential impact on data and system availability is high.
For a business NAS, the risk is therefore not limited to temporary loss of access to the administration interface. The ability to read or modify arbitrary files may affect shared folders, operational documents, and backups stored on the device.
The CVSS score alone does not indicate whether the NAS is accessible from the public internet, isolated from workstations, or available only from the internal network. These circumstances affect the actual attack surface, but they do not change whether the installed build is vulnerable.
Check the storage and backup before updating
Do not delay a critical fix, but do not install it without performing basic checks on the device. A safe procedure consists of four steps.
1. Record the model, DSM branch, and full build number
Do not rely on an outdated inventory spreadsheet. Retrieve the information directly from every NAS operated by the company. Check production and backup devices separately; an updated backup NAS does not prove that the production system is also up to date.
2. Check the storage pool and volume status
Before restarting, verify that DSM is not reporting a degraded storage pool, a crashed volume, or a rebuild in progress. If the storage is not healthy, do not automatically click Repair or install the update without first assessing its condition. We explain the next steps in Synology reports a volume problem: when to take action.
3. Verify a separate backup
RAID is primarily designed to maintain operations after a disk failure. It is not a substitute for a backup. Similarly, a snapshot stored only on the NAS being updated is not a separate copy.
A green status indicator for the latest backup job is not enough. Try restoring several selected files from the separate backup and verify that they contain the expected data. You can find a practical procedure in Backup restore testing: how to perform and document it.
4. Schedule a maintenance window
The update may require a restart. Expect a temporary interruption to shared folders, backup jobs, synchronization, and applications running on the NAS. Notify users of the outage in advance and identify which processes must be checked immediately after startup.
How to complete the update
Install at least the earliest fixed build listed for the DSM branch in use. For a manual installation, the update package must match the exact NAS model; follow Synology’s instructions.
After the restart, do not stop checking once the login screen appears. Verify:
- the full DSM build number against the table,
- the status of the storage pool and all volumes,
- the availability of the shared folders in use,
- access permissions for standard users,
- the status of backup and synchronization jobs,
- the operation of the applications actually running on the NAS.
Record the outcome in your IT documentation: the device identifier, previous and new builds, time of the intervention, backup status, and checks performed. If the company operates multiple NAS devices, repeat the verification for each one.
If you do not know the status of every device, lack a verified separate backup, or use the NAS to provide critical business services, we can carry out the checks and update as part of managed business IT services. The intended result is documented proof of a fixed build, accessible data, and verified services—not merely clicking the Update button.
Why hiding DSM from the internet is not enough
Removing a port-forwarding rule, restricting access with firewall rules, or requiring a VPN reduces the attack surface. These are sensible supplementary measures, but they do not fix the flaw in DSM.
Synology’s advisory provides no mitigation that could replace installing a fixed build. A vulnerable system may also be reachable from a compromised computer inside the corporate network, even if its administration interface is not publicly accessible.
Restrict remote access, but do not consider that a complete remedy. We discuss secure access to business systems in more detail in Remote access to company systems: RDP, VPN, and ZTNA.
Frequently asked questions
Which vulnerabilities have a CVSS score of 9.8?
CVE-2026-13684 and CVE-2026-13639. According to Synology, they can be exploited remotely without authentication or user interaction.
Is every DSM 7.2 installation vulnerable?
No. The full branch and exact build number determine whether the installation is vulnerable. For example, in the DSM 7.2.2 branch, builds earlier than 7.2.2-72806-9 are vulnerable.
Is blocking internet access to DSM enough?
No. Restricting access reduces the attack surface, but Synology provides no mitigation for these vulnerabilities that could replace the update.
Should I install the update without a backup?
First verify that you have a usable separate backup and plan the work so the vulnerable system does not remain in operation longer than necessary. If the storage pool is degraded or a volume is reporting errors, assess the storage condition first.
What must I check after the update?
Check the exact DSM build, storage pool and volume status, shared-folder availability, permissions, backup jobs, synchronization, and the applications running on the NAS.
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).