CVE-2026-13673 Synology CVE debrief

Who should care

System administrators and security teams responsible for Synology DSM installations should assess exposure and apply patches or mitigations as needed. They should also review compensating controls for exposed systems, check relevant monitoring and logs, and track exceptions and retest remediated assets.

Why it matters

CVE-2026-13673 is a high-severity vulnerability in Synology DSM LDAP API that allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks. Defenders should prioritize verifying and applying patches, restricting access to the LDAP API, and monitoring for suspicious activity. Evidence from official sources is limited, and additional verification is necessary to determine the full scope of the vulnerability.

• Remote authenticated users can read or write arbitrary files.
• Remote authenticated users can conduct denial-of-service attacks.
• Verification of patch application is necessary to prevent exploitation.
• Inventory checks are required to identify potentially affected systems.

Technical summary

CVE-2026-13673 is an incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. This allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks. Defenders should prioritize verifying and applying patches for Synology DSM versions before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Verification of patch application is necessary to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and applying patches for Synology DSM versions before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075.

Recommended defensive actions

• Verify and apply patches for Synology DSM versions before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075.
• Restrict access to the LDAP API to trusted users and networks.
• Monitor for suspicious activity related to file access and denial-of-service attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information from Synology's advisory may be necessary for comprehensive assessment. Evidence from official sources is limited, and additional verification is necessary to determine the full scope of the vulnerability. Defenders should verify patch application and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.