Do Son A widespread Synology NAS ransomware wave targets exposed devices via patched DSM vulnerabilities. Update firmware immediately to prevent encryption.
Synology
Synology fixed 8 DSM vulnerabilities, including two critical unauthenticated flaws (CVE-2026-13684, CVE-2026-13639) on DiskStation Manager. Update now.
Synology MailPlus Server has three new flaws, including CVE-2026-13136 at CVSS 10. Update to 4.0.1-31663 now. No exploit confirmed.
Synology released updates fixing critical Synology Chat Server vulnerabilities. Learn how to update your DSM package to prevent file leaks.
Synology patches critical DSM flaws (CVSS 8.0) allowing file manipulation and data leaks. Secure your NAS—upgrade to DSM 7.3, 7.2.2, or 7.2.1 immediately!
Synology urges SSL VPN Client users to update to v1.4.5-0684. Fixes critical 8.1 CVSS flaw allowing PIN theft and traffic interception. Secure your data now!
Synology patches a critical 9.8 CVSS Telnet flaw (CVE-2026-32746). Unauthenticated attackers can hijack your NAS. Update DSM or disable Telnet now!
On January 29, 2026, Synology, a preeminent manufacturer of Network Attached Storage (NAS) solutions, disseminated a series...
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Critical Synology BeeStation Zero-Day (CVE-2025-12686) Found at Pwn2Own Allows Remote Code Execution
Synology patched a Critical (CVSS 9.8) RCE zero-day flaw (CVE-2025-12686) in BeeStation OS. The vulnerability, found during Pwn2Own, allows remote attackers to execute arbitrary code. Update to v1.3.2-65648.
A flaw (CVE-2025-4679) in Synology ABM leaked a static client_secret, allowing unauthenticated attackers read-only access to all Microsoft 365 tenants with ABM installed.
CVE-2024-10442 allows unauthenticated RCE on Synology DS1823xs+ via Replication Service flaw. Patch now to avoid exploit risk.
Synology restricts third-party drives in its 2025 Plus NAS series, limiting features like health reports. Learn about the new policy and workarounds.
Learn about CVE-2024-10442, a critical vulnerability in Synology's Replication Service that allows remote command execution.
Learn about the recent zero-day vulnerabilities found in Synology camera products. Take action to protect your devices from potential attacks
Learn about the format string vulnerability in Synology TC500 security camera, and how it enables attackers to bypass memory protection.
The most severe vulnerability (CVE-2024-39349) was a classic buffer overflow in the libjansson component, which could enable RCE
Synology has released a critical security advisory detailing multiple vulnerabilities in their Surveillance Station software
CVE-2022-43931, is an out-of-bounds write vulnerability in Synology VPN Plus Server, allows remote attackers to execute arbitrary commands