Synology DSM SCGI and Login Logic Vulnerabilities (CVE-2026-13684, CVE-2026-13639)

Synology's advisory Synology_SA_26_13 covers eight vulnerabilities in DSM, the operating system for its DiskStation NAS devices. Two score 9.8 Critical in CVSS 3.1, and both need no login. CVE-2026-13684 sits in SCGI, and CVE-2026-13639 sits in the DSM login logic.

The CVE record says CVE-2026-13684 is an improper encoding or escaping of output flaw in SCGI (CWE-116). It lets remote attackers read or write arbitrary files and cause denial of service. CVE-2026-13639 is an insufficient entropy flaw in the login logic (CWE-331), with the same two outcomes. Neither flaw needs a password or a user to click anything.

What the Other Six CVEs Allow

The table below follows Synology's own order and wording. Three of the eight flaws, CVE-2026-13684, CVE-2026-13639 and CVE-2026-13635, need no account. CVE-2026-13673, CVE-2026-6205 and CVE-2026-13666 need a signed-in user. CVE-2026-13623 and CVE-2026-13683 need an administrator account.

CVE	CVSS 3.1	Severity	Component
CVE-2026-13684	9.8	Critical	SCGI
CVE-2026-13639	9.8	Critical	Login logic
CVE-2026-13673	8.8	Important	LDAP API
CVE-2026-6205	8.1	Important	Upload API
CVE-2026-13635	5.3	Moderate	Auth API
CVE-2026-13623	4.8	Moderate	Theme API
CVE-2026-13666	3.5	Low	Sharing API
CVE-2026-13683	2.7	Low	EventScheduler API

CVE-2026-13635 only lets an attacker obtain non-sensitive information; it does not share the file read or write impact of the two Critical flaws. CVE-2026-6205 lets a signed-in user write arbitrary files, not read them. CVE-2026-13666 needs a victim to click a sharing link first.

Who Found These Flaws

Synology credits six researchers for the eight CVEs. They are Lam Jun Rong, DungNBN with Scamman from Trung Tâm Săn Lỗi Lậu Hải Ngoại, Uky, Juhyeop Lee of STEALIEN, Brendan O'Rourke, and WinD39 of Viettel Cyber Security. The advisory does not say which researcher found which CVE.

What Synology Says About Exploitation

On 29 October 2026, Synology published a separate statement that threat actors are deploying ransomware against DSM devices left on outdated versions. Synology attributes the campaign to the flaw fixed by its earlier advisory, Synology_SA_24_20, published in November 2024. Synology's statement does not name a CVE from Synology_SA_26_13.

Qihoo 360 published its own report on the same wave on 29 October 2026. 360 attributes the ransomware to CVE-2026-13639 and CVE-2026-13684 instead, not the 2024 flaw Synology named. Sources differ on which flaw the wave actually used, and we could not confirm either attribution independently.

360's report adds technical detail. The ransomware targets 187 file extensions and renames encrypted files with a ".L0CK3D" extension. It also drops a "read-me3.txt" ransom note on each affected system.

These are the public signals we checked on 2 November 2026.

A GitHub user published a detection-only scanner on 30 October 2026 that checks a DSM device's reported build number against the fixed versions for CVE-2026-13684, CVE-2026-13639 and the older CVE-2024-10441. Its own description says no exploit code was included, only read-only version checks.

Brandefense tracks disputes like this as part of its ransomware intelligence coverage. The wave itself fits the pattern of ransomware-as-a-service tooling, where the same encryption kit can follow more than one entry flaw.

Synology's advisory lists one shared table for all eight CVEs. Every DSM branch gets one fixed build, and that build closes every CVE in the advisory at once.

The advisory's own "Affected Products" table marks every branch Critical. That reflects the two 9.8 flaws on each branch, not every CVE; the per-CVE severities in the table above still apply.

Synology's mitigation line for this advisory reads "None." The only fix it gives is the version upgrade. The Hong Kong Computer Emergency Response Team Coordination Centre reposted the same versions and fixed builds in its own bulletin on 2 November 2026.

Any DSM box reachable from the internet stays the most exposed device until that upgrade lands. Finding every such box across a fleet is a basic external attack surface management task, not a one-time check.

A GitHub user published a detection-only scanner on 30 October 2026. It fingerprints a DSM device's build number over a read-only API call and compares it with these fixed builds, and with the fixed build for the older CVE-2024-10441. Its own description says no exploit code was included, only read-only checks.