CVE-2026-13639: Synology DiskStation (DSM), Synology DiskStation Manager (DSM)

This is a record in the CVE List, the public register of security flaws. The title and any summary are in the source's own words.

An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Kind: Check with your IT provider
Started: 18 Sept 2026, 09:21
Why we can name the supplier: An official register says it: a CVE record, CISA's list of exploited flaws or the NCSC

Read it at the source

Products it names

Synology DiskStation (DSM) (Synology)
Synology DiskStation Manager (DSM) (Synology)

The latest

We aim to update this thread. For the latest, check the supplier's own page directly: www.cve.org/CVERecord?id=CVE-2026-13639.

This entry comes from our research build of public sources made on 24 Oct 2026.