CVE-2026-13684 Synology CVE debrief

Who should care

Administrators of Synology DiskStation Manager (DSM) systems, Security teams responsible for patch management and vulnerability remediation, Operators of affected DSM versions, and Security teams responsible for monitoring and incident response. They should review and apply patches from Synology for affected DSM versions, restrict access to SCGI interfaces, and monitor for suspicious activity.

Why it matters

CVE-2026-13684 is a critical vulnerability in Synology DiskStation Manager (DSM) that requires immediate attention from administrators and security teams.

• Remote attackers can read or write arbitrary files
• Denial-of-service attacks are possible
• Patching is required to prevent exploitation

Technical summary

The vulnerability is caused by an improper encoding or escaping of output in SCGI, allowing remote attackers to read or write arbitrary files and conduct denial-of-service attacks. The vulnerability has a CVSS score of 9.8 and is classified as CRITICAL. Affected versions of DSM include those before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Synology has provided security advisories for affected DSM versions. Administrators and security teams should review and apply patches from Synology for affected DSM versions.

Defensive priority

High

Recommended defensive actions

• Review and apply patches from Synology for affected DSM versions
• Restrict access to SCGI interfaces
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by an improper encoding or escaping of output in SCGI. Affected versions of DSM include those before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The vulnerability has a CVSS score of 9.8 and is classified as CRITICAL. Synology has provided security advisories for affected DSM versions. Administrators and security teams should review and apply patches from Synology for affected DSM versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.