Executive Summary
Synology has patched a second critical, unauthenticated vulnerability disclosed alongside CVE-2026-13639 in the same bundled advisory, Synology-SA-26:13. Tracked as CVE-2026-13684 (CVSS 9.8), the flaw is an improper encoding or escaping of output issue in DSM's SCGI (Simple Common Gateway Interface) handling. Per NVD, it "allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks" — with no authentication or user interaction required.
SCGI is a backend protocol DSM uses to pass requests between its web-facing components and internal services, similar in role to FastCGI. An output-encoding failure in that path means data crossing the SCGI boundary isn't safely escaped before it's interpreted downstream, giving an attacker a way to manipulate what the receiving service does with it.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-13684 |
| CWE | Improper Encoding or Escaping of Output |
| CVSS Score | 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Component | SCGI |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Advisory | Synology-SA-26:13 |
| Reserved | June 29, 2026 |
| Published | September 18, 2026 |
Root Cause
SCGI is used internally to relay requests from DSM's front-end web server to backend service processes. When output crossing that interface isn't properly encoded or escaped, an attacker who can influence the request can smuggle data that the receiving SCGI backend interprets as something other than plain content — for example, extra protocol fields or unintended file paths. Synology's severity assessment (unauthenticated arbitrary file read/write plus denial-of-service) indicates the encoding gap is reachable and impactful enough to manipulate what the backend reads or writes without any prior authentication.
Affected Products
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Synology DSM | Prior to 7.2.1-69057-12 | 7.2.1-69057-12 |
| Synology DSM | Prior to 7.2.2-72806-9 | 7.2.2-72806-9 |
| Synology DSM | Prior to 7.3.2-86009-4 | 7.3.2-86009-4 |
| Synology DSM | Prior to 7.4-90075 | 7.4-90075 |
This is one of two critical, unauthenticated flaws Synology patched in the same advisory — the other, CVE-2026-13639, is an insufficient-entropy issue in DSM's login logic, also CVSS 9.8. A third bundled issue, CVE-2026-13635, discloses non-sensitive information to unauthenticated attackers. All three ship in the same fixed builds, so a single DSM update resolves the full set.
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Arbitrary File Read/Write | Unauthenticated access to files outside intended SCGI request scope |
| Denial of Service | Ability to disrupt the backend service or DSM availability |
| No Authentication Barrier | Exposure scales directly with how many DSM instances are network-reachable |
Remediation
- Update DSM immediately to 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, or 7.2.1-69057-12, matching your installed major version. Synology has published no workaround.
- Restrict DSM's management interface to trusted networks — never expose it directly to the internet.
- Patch CVE-2026-13639 and CVE-2026-13635 in the same maintenance window; all three ship together.
- Review file-integrity and access logs for anomalous reads/writes predating the patch.
Detection Indicators
| Indicator | Description |
|---|---|
| Malformed or unexpected SCGI request payloads | Possible output-encoding exploitation attempt |
| File access or modification outside expected service scope | Sign of successful arbitrary file read/write |
| Unexplained crashes or restarts in DSM backend services | Possible denial-of-service exploitation |
| Internet-facing DSM management ports | Increases exposure to remote, unauthenticated attack |