CVE-2026-13673 Synology CVE debrief

Who should care

System administrators and security teams responsible for Synology DiskStation Manager (DSM) deployments should assess exposure and apply necessary updates or mitigations. This includes verifying DSM versions, reviewing and limiting LDAP API access, and monitoring for suspicious activity.

Why it matters

CVE-2026-13673 is a high-severity vulnerability in Synology DiskStation Manager (DSM) that allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks. System administrators and security teams should assess exposure, verify DSM versions, and apply necessary updates or mitigations.

• Remote authenticated users may read or write arbitrary files
• Denial-of-service attacks may be conducted
• Verification of DSM versions and patch levels is necessary
• Remediation priority is high due to potential for significant impact

Technical summary

CVE-2026-13673 is an incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075. This allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks. System administrators and security teams should assess exposure, verify DSM versions, and apply necessary updates or mitigations. Verification of DSM versions and patch levels is necessary. Remediation priority is high due to potential for significant impact.

Defensive priority

High

Recommended defensive actions

• Review and apply Synology's security advisories for DSM
• Verify and limit LDAP API access
• Monitor for suspicious activity
• Update DSM to the latest version
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify versions, exploitation, impact, or remediation beyond vendor advisories. Synology security advisories should be reviewed for specific DSM versions and patch levels. Verification of DSM versions and patch levels is necessary. Remediation priority is high due to potential for significant impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.