Executive Summary
Synology has patched a critical insufficient-entropy vulnerability (CVE-2026-13639, CVSS 9.8) in the login logic of DiskStation Manager (DSM), the web-based operating system that runs on the company's NAS appliances. Per NVD, the flaw "allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks" — and critically, it requires no authentication and no user interaction to trigger.
The bug was disclosed alongside a companion flaw, CVE-2026-13684, in Synology's bundled advisory Synology-SA-26:13, which patches eight DSM issues in total. CVE-2026-13639 and CVE-2026-13684 are the two rated critical and unauthenticated; the remaining six require an authenticated session (some requiring admin privileges) and are rated lower.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-13639 |
| CWE | CWE-331 (Insufficient Entropy) |
| CVSS Score | 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Component | DSM login logic |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Advisory | Synology-SA-26:13 |
| Reserved | June 29, 2026 |
| Published | September 18, 2026 |
Root Cause
The flaw lives in how DSM's login logic generates values that are supposed to be unpredictable — most likely a session token, nonce, or similar identifier used during authentication. When that value is derived from a weak or insufficiently random source, an attacker can predict or brute-force it far more easily than the design assumes. Synology and NVD's combined severity assessment — unauthenticated arbitrary file read/write and denial-of-service — indicates the predictable value can be leveraged to bypass or subvert the login flow entirely rather than just weakening session security at the margins.
Because no credentials or user interaction are required, any DSM instance reachable on the network is a viable target, not just ones with weak admin passwords or exposed management ports.
Affected Products
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Synology DSM | Prior to 7.2.1-69057-12 | 7.2.1-69057-12 |
| Synology DSM | Prior to 7.2.2-72806-9 | 7.2.2-72806-9 |
| Synology DSM | Prior to 7.3.2-86009-4 | 7.3.2-86009-4 |
| Synology DSM | Prior to 7.4-90075 | 7.4-90075 |
A related flaw disclosed in the same advisory, CVE-2026-13684 (also CVSS 9.8), is an improper output-encoding issue in DSM's SCGI component with the same unauthenticated file read/write and DoS impact. A third issue in the bundle, CVE-2026-13635, allows a remote attacker to obtain non-sensitive information. Organizations patching DSM should treat all three as part of the same update cycle.
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Arbitrary File Read/Write | Unauthenticated access to files on the NAS outside intended scope |
| Denial of Service | Ability to disrupt DSM availability without any prior access |
| Full NAS Exposure | Since no credentials are needed, exposure scales with how many DSM instances are internet-facing |
Remediation
- Update DSM immediately to 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, or 7.2.1-69057-12, matching your installed major version. Synology has published no workaround — patching is the only fix.
- Do not expose DSM's management interface directly to the internet. Place it behind a VPN or Synology's QuickConnect/reverse-proxy options with access restricted to trusted networks.
- Audit login and access logs for unusual authentication activity in the period before patching.
- Apply the fix for CVE-2026-13684 and CVE-2026-13635 in the same maintenance window, since they ship in the same DSM builds.
Detection Indicators
| Indicator | Description |
|---|---|
| Unexpected authentication attempts with malformed or repeated tokens | Possible entropy-prediction exploitation attempt |
| File access or modification outside expected user/package scope | Sign of successful arbitrary file read/write |
| Unexplained DSM service restarts or crashes | Possible denial-of-service exploitation |
| Internet-facing DSM management ports | Increases exposure to remote, unauthenticated attack |