Search: CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

In October 2026, Synology NAS devices running outdated DiskStation Manager (DSM) versions were targeted by C3RB3R ransomware. The ransomware encrypts user files, appending a .L0CK3D extension, and leaves ransom notes demanding payment for decryption. The attack exploits a critical unauthenticated remote code execution vulnerability fixed in December 2024 (likely CVE-2024-10441) and possibly other critical vulnerabilities patched in September 2026. Infection requires only that the NAS be accessible over the internet or local network and not updated. Users are advised to disconnect infected devices from networks and update DSM immediately to mitigate risk.