Synology DiskStation Manager vulnerabilities under active exploit
Two critical vulnerabilities in Synology DiskStation Manager are being exploited in the wild to deploy ransomware. Synology published patches in September, but Qihoo 360 researchers reported in late October that attackers are using the flaws to install C3RB3R, a Cerber ransomware variant, on unpatched NAS devices.
CVE-2026-13684 is an improper encoding flaw in SCGI, and CVE-2026-13639 is an insufficient entropy issue in login logic. Both score 9.8 and allow remote unauthenticated attackers to read or write arbitrary files and trigger denial-of-service. The CCB advisory confirms active exploitation and recommends patching with the highest priority after testing.
Affected versions are DSM 7.4 before 7.4-90075, DSM 7.3.2 before 7.3.2-86009-4, DSM 7.2.2 before 7.2.2-72806-9, and DSM 7.2.1 before 7.2.1-69057-12. Upgrade to the fixed release for your branch immediately. If your devices are exposed to the internet or untrusted networks, treat this as urgent.
Patching stops new attacks but does not undo prior compromise. The CCB recommends upscaling monitoring and detection to identify suspicious activity on devices that were vulnerable during the exploitation window. Check logs, file integrity, and user accounts for signs of tampering.
If you run Synology NAS in production and need help auditing exposure, planning the upgrade, or investigating potential compromise, we can walk through it with you.