VulnSocial

CVE-2026-13684Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-116

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 9 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 8 signals
  • Disclosure: 4 classified signals
  • Peaked 3d ago at 3 mentions (2026-09-18); latest day: 2
  • 9 total mentions across 4 days

Deep dive

Activity timeline9 mentions / 4d
01223Mentions · 2026-09-18: 3Mentions · 2026-09-19: 2Mentions · 2026-09-21: 2Mentions · 2026-10-30: 2Active Exploitation · 2026-10-30: 1Patch / Workaround · 2026-09-18: 2Patch / Workaround · 2026-09-19: 1Patch / Workaround · 2026-10-30: 1Technical Details · 2026-09-18: 3Technical Details · 2026-09-19: 2Technical Details · 2026-09-21: 2Technical Details · 2026-10-30: 109-1809-1909-2110-30
Signal classification3 categories
Disclosure
450.0%
Patch
337.5%
Active Exploitation
112.5%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-09-183
Disclosure1Patch2
2026-09-192
Disclosure1Patch1
2026-09-212
Disclosure2
2026-10-302
Active Exploitation1
Full discourse9 posts
  • Dark Web Intelligence@DailyDarkWeb
    Patch

    🚨 SYNOLOGY DSM CRITICAL: UNAUTH ARBITRARY FILE R/W (CVSS 9.8) Synology published Synology-SA-26:13 for DiskStation Manager, rating the advisory Critical. Two unauthenticated remote vulnerabilities are scored CVSS 9.8: • CVE-2026-13684 — SCGI improper encoding/escaping; arbitrary file read/write and DoS • CVE-2026-13639 — login insufficient entropy; arbitrary file read/write and DoS Additional Important issues allow authenticated arbitrary file read/write (CVE-2026-13673) and arbitrary write (CVE-2026-6205). Affected: DSM 7.4 / 7.3 / 7.2.2 / 7.2.1. Fixed builds listed in the advisory. No workaround — upgrade. Official advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_26_13 #DDW #DarkWeb #Synology #DSM #CVE #CyberSecurity #ThreatIntelligence

    Post summary

    Synology released a critical advisory for multiple unauthenticated file read/write vulnerabilities in DSM (CVE‑2026‑13684, CVE‑2026‑13639, etc.) with CVSS 9.8 and urges users to upgrade to the fixed builds to patch the flaws.

    0202097.2K
    209.0K followersView on X
  • JustaBreach@justabreach

    🚨 Alerte Synology NAS: Ransomware C3RB3R en cours Des NAS Synology se font chiffrés leurs données avec l’extension .L0CK3D + note read-me3.txt (demande de rançon de 0,037 BTC). Attribué à C3RB3R (variante Cerber). Vecteur principal : CVE-2026-13639 & CVE-2026-13684 (CVSS 9.8) dans DSM, corrigées dès le 18 sept. 2026 (SA-26:13). 👉 Si votre DSM n’est pas à jour (7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12 ou plus récent) et exposé : mettez à jour MAINTENANT. Sinon (ou pour les anciennes versions): ne les exposez plus sur internet ou priez… #Synology #Ransomware #C3RB3R

    230862.6K
    3.5K followersView on X
  • Netlas.io@Netlas_io
    Disclosure

    CVE-2026-13684 and others: Multiple vulnerabilities in Synology DSM, up to 9.8 Rating 🔥 Synology has disclosed 8 vulnerabilities in DiskStation Manager (DSM); 2 of them allow a remote unauthenticated attacker to read or write files and cause a denial of service on affected devices. 👉 https://nt.ls/dgzix

    Post summary

    The tweet announces multiple Synology DSM vulnerabilities with technical details and a high CVSS score, but does not provide a patch or exploit code.

    13061721
    7.8K followersView on X
  • CCB Alert@CCBalert
    Disclosure

    Warning: Critical vulnerabilities in #Synology DSM. CVE-2026-13639 & CVE-2026-13684 CVSS:9.8. Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to read or write arbitrary files and potentially conduct denial-of-service attacks #DoS. #Patch

    Post summary

    The text serves as a disclosure announcement for two critical Synology DSM vulnerabilities (CVE-2026-13639 and CVE-2026-13684), providing CVSS scores and technical impact details, but lacks mention of PoCs, active exploitation, specific patches, or exploit tools.

    12023547
    7.3K followersView on X
  • 轩源@4xy
    Active Exploitation

    群晖 DSM 有两条严重远程漏洞，未登录即可读写任意文件（CVE-2026-13684、CVE-2026-13639，CVSS 3.1 均为 9.8）。补丁已于 2026 年 9 月 18 日发布。360 于 10 月确认 Cerber 变种 C3RB3R 正在用这两条漏洞加密 NAS 文件，加密后后缀为 .L0CK3D。 https://x.com/i/article/2115999599139897346

    Post summary

    The text identifies two critical remote vulnerabilities in Synology DSM, confirms active exploitation by a Cerber variant, and notes the patch release date.

    01123650
    375 followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Synology fixed 8 DSM vulnerabilities, including two critical unauthenticated flaws (CVE-2026-13684, CVE-2026-13639) on DiskStation Manager. Update now. #Synology #DSM #NAS #CVE #Vulnerability #DiskStation #InfoSec #PatchNow #NetworkSecurity #DataStorage https://securityonline.info/synology-dsm-vulnerabilities-sa-26-13/

    Post summary

    The post reports that Synology fixed eight DSM vulnerabilities, including two critical unauthenticated flaws, and urges users to update their systems.

    00031506
    13.0K followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen Synology DSM: Zwei kritische Schwachstellen mit CVSS 9.8 betreffen Login-Logik und SCGI #cve202613639 #cve202613684 #diskstationmanager #dsm #synology https://cybersecurity-news.de/synology-dsm-cve-2026-13639-cve-2026-13684

    Post summary

    The tweet discloses two critical Synology DSM vulnerabilities (CVE‑2026‑13639 and CVE‑2026‑13684) with a CVSS score of 9.8 affecting login logic and SCGI, but it does not mention a PoC, exploit tool, active exploitation, or patch.

    0000045
    13 followersView on X
  • ThreatAft@ThreatAft
    Disclosure

    🔐🚨 SYNOLOGY DSM — CVSS 9.8 ×2 CVE-2026-13639: Insufficient entropy → session token prediction CVE-2026-13684: SCGI injection → arbitrary file read/write → https://threataft.com/articles/synology-dsm-cve-2026-13639-cve-2026-13684-unauthenticated-rce #Synology #DSM #CVE #NAS #PatchNow #CyberSecurity #ThreatIntel

    Post summary

    The tweet discloses two critical CVEs (CVE-2026-13639 and CVE-2026-13684) in Synology DSM with CVSS 9.8 scores, detailing the vulnerability types (session token prediction via insufficient entropy and arbitrary file read/write via SCGI injection) and linking to an article describing unauthenticated RCE.

    0000066
    43 followersView on X
  • NEXSIGHT@NEXSIGHTNEWS
    Patch

    SynologyのNAS用OS「DSM」に8件の脆弱性 — うち2件は未認証の攻撃者が任意のファイルを読み書きできる重大な欠陥、修正版を公開 https://cyber.nexsight.co/articles/2026/09/18/synology-dsm-sa-26-13-eight-vulnerabilities-cve-2026-13684-2026-09-18/

    Post summary

    The tweet reports eight vulnerabilities in Synology DSM, two of which enable unauthenticated arbitrary file read/write, and notes that a patched version has been released.

    0000061
    74 followersView on X

Explore more

Back to dashboard