A security update has been released to address several vulnerabilities in Synology products, particularly DiskStation Manager (DSM). – The vulnerabilities addressed are CVE-2026-6205, CVE-2026-13623, CVE-2026-13635, CVE-2026-13639, CVE-2026-13666, CVE-2026-13673, CVE-2026-13683, and CVE-2026-13684.
The affected DSM versions are 7.2.1, 7.2.2, 7.3, and 7.4.
The vulnerability types include file name or Path control vulnerabilities caused by external input, cross-site scripting (XSS) vulnerabilities, vulnerabilities due to improper encoding or escaping of output, entropy deficiency vulnerabilities, CRLF injection vulnerabilities, improper permission assignment for critical resources, and SQL injection vulnerabilities.
Applying the latest updates provides patches for CVE-2026-6205, CVE-2026-13623, CVE-2026-13635, CVE-2026-13639, CVE-2026-13666, CVE-2026-13673, CVE-2026-13683, and CVE-2026-13684.
Users are advised to update to DSM 7.2.1-69057-12 or later, DSM 7.2.2-72806-9 or later, DSM 7.3.2-86009-4 or later, or DSM 7.4-90075 or later.
The Synology-SA-26:13 DSM announcement was provided as a reference.
