CVE-2026-13639Patch

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (3 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Back to dashboard

5.5/ 10 priority

Sources & remediation

Other references

https://www.synology.com/en-global/security/advisory/Synology_SA_26_13

Weakness type (CWE)

CWE-331

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
11 mentions across 6 observed days

What's happening

Active exploitation reported across 2 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 6 signals
Technical details provided in 8 signals
Disclosure: 3 classified signals
Peaked 5d ago at 3 mentions (2026-09-18); latest day: 3
11 total mentions across 6 days

Deep dive

Activity timeline11 mentions / 6d

Signal classification3 categories

Patch

444.4%

Disclosure

333.3%

Active Exploitation

222.2%

Referenced assets15 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-18	3	Disclosure1Patch2
2026-09-19	2	Disclosure1Patch1
2026-09-21	1	Patch1
2026-09-24	1	Disclosure1
2026-10-29	1	Active Exploitation1
2026-10-30	3	Active Exploitation1

Full discourse11 posts

Dark Web Intelligence@DailyDarkWeb45d
Patch
🚨 SYNOLOGY DSM CRITICAL: UNAUTH ARBITRARY FILE R/W (CVSS 9.8) Synology published Synology-SA-26:13 for DiskStation Manager, rating the advisory Critical. Two unauthenticated remote vulnerabilities are scored CVSS 9.8: • CVE-2026-13684 — SCGI improper encoding/escaping; arbitrary file read/write and DoS • CVE-2026-13639 — login insufficient entropy; arbitrary file read/write and DoS Additional Important issues allow authenticated arbitrary file read/write (CVE-2026-13673) and arbitrary write (CVE-2026-6205). Affected: DSM 7.4 / 7.3 / 7.2.2 / 7.2.1. Fixed builds listed in the advisory. No workaround — upgrade. Official advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_26_13 #DDW #DarkWeb #Synology #DSM #CVE #CyberSecurity #ThreatIntelligence
Post summary
The tweet discloses two critical Synology DSM vulnerabilities (CVE-2026-13684, CVE-2026-13639) allowing unauthenticated arbitrary file read/write and advises upgrading to fixed builds as no workaround exists.
0202097.2K
209.0K followersView on X
JustaBreach@justabreach3d
🚨 Alerte Synology NAS: Ransomware C3RB3R en cours Des NAS Synology se font chiffrés leurs données avec l’extension .L0CK3D + note read-me3.txt (demande de rançon de 0,037 BTC). Attribué à C3RB3R (variante Cerber). Vecteur principal : CVE-2026-13639 & CVE-2026-13684 (CVSS 9.8) dans DSM, corrigées dès le 18 sept. 2026 (SA-26:13). 👉 Si votre DSM n’est pas à jour (7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12 ou plus récent) et exposé : mettez à jour MAINTENANT. Sinon (ou pour les anciennes versions): ne les exposez plus sur internet ou priez… #Synology #Ransomware #C3RB3R
230862.6K
3.5K followersView on X
CCB Alert@CCBalert42d
Patch
Warning: Critical vulnerabilities in #Synology DSM. CVE-2026-13639 & CVE-2026-13684 CVSS:9.8. Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to read or write arbitrary files and potentially conduct denial-of-service attacks #DoS. #Patch
Post summary
The post highlights critical vulnerabilities in Synology DSM with high CVSS scores and recommends patching; technical impact is described but no active exploitation or PoC is referenced.
12023547
7.3K followersView on X
轩源@4xy4d
Active Exploitation
群晖 DSM 有两条严重远程漏洞，未登录即可读写任意文件（CVE-2026-13684、CVE-2026-13639，CVSS 3.1 均为 9.8）。补丁已于 2026 年 9 月 18 日发布。360 于 10 月确认 Cerber 变种 C3RB3R 正在用这两条漏洞加密 NAS 文件，加密后后缀为 .L0CK3D。 https://x.com/i/article/2115999599139897346
Post summary
Two critical Synology DSM vulnerabilities (CVE-2026-13684, CVE-2026-13639) with CVSS 9.8 were patched on Sep 18, 2026, and confirmed to be actively exploited by Cerber ransomware variant C3RB3R to encrypt NAS files.
01123650
375 followersView on X
VulnTracker@vuln_tracker45d
Patch
Predictable values in Synology DSM's login logic let remote attackers read, write, and crash the system no login required (CVSS 9.8). CVE-2026-13639 is an insufficient entropy flaw that lets an unauthenticated attacker read or write arbitrary files and trigger denial-of-service on DiskStation Manager. Fixed in DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075. Update now. Details: http://vulntracker.io/cves/CVE-2026-13639 #Synology #DSM #CVE #NAS #InfoSec #CyberSecurity
Post summary
The advisory identifies CVE‑2026‑13639 as an entropy flaw with CVSS 9.8 severity, lists fixed DSM versions, and urges users to update, confirming a patch is available.
00042395
832 followersView on X
Daily CyberSecurity@Daily_CyberSec45d
Patch
Synology fixed 8 DSM vulnerabilities, including two critical unauthenticated flaws (CVE-2026-13684, CVE-2026-13639) on DiskStation Manager. Update now. #Synology #DSM #NAS #CVE #Vulnerability #DiskStation #InfoSec #PatchNow #NetworkSecurity #DataStorage https://securityonline.info/synology-dsm-vulnerabilities-sa-26-13/
Post summary
The text reports eight fixed DSM vulnerabilities, including two critical unauthenticated flaws, and urges users to update. It does not report active exploitation or provide PoC or exploit code.
00031506
13.0K followersView on X
테크워처@TheHour23593d
360 공식 분석 – Cerber勒索攻击群晖NAS事件预警: https://news.safe.360.cn/n/13055.html http://pwn.watch – C3RB3R ransomware hits Synology NAS: https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684 Synology – Synology-SA-26:13: https://www.synology.com/en-global/security/advisory/Synology_SA_26_13 Synology – Ransomware Attacks on Outdated DSM Versions: https://www.synology.com/en-global/company/news/article/C3RB3R/Synology%20Urges%20Users%20to%20Update%20DSM%20Following%20Ransomware%20Attacks%20on%20Outdated%20DSM%20Versions KISA – Synology 제품 보안 업데이트 권고: https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&categoryCode=&menuNo=205023&nttId=72254&pageIndex=1&searchCnd=&searchWrd= 조선비즈 – Ransomware hits Synology NAS in Korea: https://biz.chosun.com/en/en-it/2026/10/30/QW7K2CGWJJGB5IZUO227IVDRKM/
00000141
2.2K followersView on X
Marco@McCrypto4d
Active Exploitation
⚠️ Synology-NAS: Die Ransomware C3RB3R verschlüsselt seit Oktober Daten (.L0CK3D, Lösegeldnote read-me3.txt). Synology warnt heute offiziell. Ausgenutzt werden kritische Lücken ohne Login: laut 360 CVE-2026-13639/-13684 (gepatcht 18.9.), laut Synology CVE-2024-10441. Mindestens nötig: DSM 7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12. DSM nicht offen ins Netz, nur per VPN. Offline-Backup prüfen! https://www.synology.com/security/advisory/Synology_SA_26_13
Post summary
The ransomware C3RB3R has been actively exploiting unpatched Synology NAS vulnerabilities (CVE‑2026‑13639, CVE‑2026‑13684, CVE‑2024‑10441) since October, prompting an official warning and a recommendation to update DSM to specific patched versions.
00000166
494 followersView on X
SHELLCODE@sh3ll_c0d339d
Disclosure
💥 CRITICAL NAS ALERT: Synology DSM entropy flaw (CVE-2026-13639 / CVSS 9.8)! Predictable PRNG seeds & SCGI injection let unauthenticated attackers take over storage arrays. 👉 Full technical analysis: https://sh3llc0d3.com/blog/synology-dsm-under-threat-critical-entropy-flaw-allows-unauthenticated-file-takeover-cve-2026-13639/ #sh3llc0d3 #shellcode #Synology #ZeroDay
Post summary
The text discloses a critical Synology DSM vulnerability (CVE-2026-13639, CVSS 9.8) involving predictable PRNG seeds and SCGI injection for unauthenticated takeover, linking to a technical analysis blog post, but provides no patch, exploit tool, or active exploitation evidence.
00000112
107 followersView on X
Cybersecurity News DE@cybsecuritynews44d
Disclosure
#schwachstellen Synology DSM: Zwei kritische Schwachstellen mit CVSS 9.8 betreffen Login-Logik und SCGI #cve202613639 #cve202613684 #diskstationmanager #dsm #synology https://cybersecurity-news.de/synology-dsm-cve-2026-13639-cve-2026-13684
Post summary
The tweet announces two critical Synology DSM vulnerabilities (CVSS 9.8) affecting login logic and SCGI, identified as CVE-2026-13639 and CVE-2026-13684, without providing proof-of-concept code, exploit tools, patch details, or evidence of active exploitation in the wild.
0000045
13 followersView on X
ThreatAft@ThreatAft45d
Disclosure
🔐🚨 SYNOLOGY DSM — CVSS 9.8 ×2 CVE-2026-13639: Insufficient entropy → session token prediction CVE-2026-13684: SCGI injection → arbitrary file read/write → https://threataft.com/articles/synology-dsm-cve-2026-13639-cve-2026-13684-unauthenticated-rce #Synology #DSM #CVE #NAS #PatchNow #CyberSecurity #ThreatIntel
Post summary
The text announces two Synology DSM CVEs and provides technical details about their mechanisms, impacts, and CVSS score. It does not provide evidence of active exploitation, named exploit tooling, PoC sharing, or a specific patch or workaround.
0000066
43 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-13639

Dark Web Intelligence[verified]@DailyDarkWebPatch

The tweet discloses two critical Synology DSM vulnerabilities (CVE-2026-13684, CVE-2026-13639) allowing unauthenticated arbitrary file read/write and advises upgrading to fixed builds as no workaround exists.

轩源[verified]@4xyActive Exploitation

Two critical Synology DSM vulnerabilities (CVE-2026-13684, CVE-2026-13639) with CVSS 9.8 were patched on Sep 18, 2026, and confirmed to be actively exploited by Cerber ransomware variant C3RB3R to encrypt NAS files.

VulnTracker[verified]@vuln_trackerPatch

The advisory identifies CVE‑2026‑13639 as an entropy flaw with CVSS 9.8 severity, lists fixed DSM versions, and urges users to update, confirming a patch is available.

Marco[verified]@McCryptoActive Exploitation

The ransomware C3RB3R has been actively exploiting unpatched Synology NAS vulnerabilities (CVE‑2026‑13639, CVE‑2026‑13684, CVE‑2024‑10441) since October, prompting an official warning and a recommendation to update DSM to specific patched versions.

CCB Alert@CCBalertPatch

The post highlights critical vulnerabilities in Synology DSM with high CVSS scores and recommends patching; technical impact is described but no active exploitation or PoC is referenced.

Daily CyberSecurity@Daily_CyberSecPatch

The text reports eight fixed DSM vulnerabilities, including two critical unauthenticated flaws, and urges users to update. It does not report active exploitation or provide PoC or exploit code.

SHELLCODE@sh3ll_c0d3Disclosure

The text discloses a critical Synology DSM vulnerability (CVE-2026-13639, CVSS 9.8) involving predictable PRNG seeds and SCGI injection for unauthenticated takeover, linking to a technical analysis blog post, but provides no patch, exploit tool, or active exploitation evidence.

Cybersecurity News DE@cybsecuritynewsDisclosure

The tweet announces two critical Synology DSM vulnerabilities (CVSS 9.8) affecting login logic and SCGI, identified as CVE-2026-13639 and CVE-2026-13684, without providing proof-of-concept code, exploit tools, patch details, or evidence of active exploitation in the wild.