Synology NAS: review important DSM security updates
Synology's 18 September advisory lists multiple DSM vulnerabilities, including CVE-2026-13684 and CVE-2026-13639, that could allow remote attackers to read or write arbitrary files or cause denial of service. The vendor advisory did not confirm exploitation in the wild.
Basis: the official source labels this critical. GDMME follow-up priority uses official ratings and headline/summary rules. It is not a CVSS score or official vulnerability rating, and does not confirm that your business is affected.
Source severity
Critical（Synology）
Affected scope
Deployments in the DSM 7.4, 7.3, 7.2.2 and 7.2.1 branches that are earlier than their respective patched versions.
Official recommendations
The official source is linked here; its recommendation text has not been extracted.
尚未取得可核實的官方建議摘錄；請閱讀官方原公告及原廠指引
GDMME recommended actions
GDMME recommendations · automatically organised from explicit products and source signals, without individual human analysis. Confirm applicability against vendor guidance and your environment.
- Locate Synology deployments, running versions and service owners in your inventory or management console; compare them with the vendor applicability criteria. A named product does not mean every deployment is affected.
- Check internet-reachable management interfaces, VPN access and administrator accounts on Synology. Restrict unnecessary exposure using vendor guidance after confirming administration and remote-work needs.
- Once Synology applicability is confirmed, check the official excerpt and complete vendor patch/mitigation instructions. Record before/after versions, test results and rollback steps; do not install updates solely from a news headline.
- Review administrator sign-ins, configuration changes and VPN sessions on Synology against authorised changes. Preserve logs and use the incident procedure for unfamiliar admin accounts or unauthorised changes.
Automatically organised (Hong Kong time)：2026/10/12 03:05 HKT
Educational information only. Confirm affected versions, mitigations and exploitation status with the original vendor advisory. Reports do not imply that GDMME equipment blocks every vulnerability.