CVE-2026-13684 / CVE-2026-13639, Synology DSM: two unauthenticated CVSS 9.8 flaws (SCGI output-encoding bug, login-logic entropy weakness) allow remote arbitrary file read/write and denial-of-service with no credentials; C3RB3R ransomware is now encrypting NAS on outdated DSM
C3RB3R ransomware encrypts Synology NAS; Synology confirms exploitation, 360 names the September 9.8 pair
Defender actions
- Update every Synology DSM to the fixed build of its branch now (7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12, and 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8 on the branches for which SA-26:13 names no fix), taking the management interface of any NAS that is reachable from the internet offline first, because Synology confirms ransomware is exploiting outdated DSM and lists no mitigation for the September flaws.
- On every NAS that was reachable from the internet on an older build, look in its shares for files renamed to .L0CK3D and for read-me3.txt notes, and isolate any hit.
Analysis
Synology disclosed eight CVEs in DiskStation Manager (DSM) on 2026-09-18 (Synology-SA-26:13). Two are unauthenticated and rated CVSS 9.8, CVE-2026-13684 (improper output encoding in the SCGI component) and CVE-2026-13639 (insufficient entropy in the login logic), and each lets a remote attacker with no credentials read or write arbitrary files and cause denial-of-service. Two more need only a low-privileged session: CVE-2026-13673 (8.8, LDAP API) and CVE-2026-6205 (8.1, Upload API). All four are fixed in DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12, and Synology lists no mitigation for the unauthenticated pair (Synology PSIRT, 2026-09-18).
NCSC Switzerland recorded exploitation status as unknown on 2026-09-21 (NCSC Switzerland, 2026-09-21), and CERT-FR relayed the advisory the same day without commenting on exploitation (CERT-FR, 2026-09-21). heise online expected the terse advisory to draw ransomware authors and other criminals quickly, since Synology describes exploitation as very easy (translated from German) (heise online, 2026-09-18).
Synology said on 2026-10-29 that threat actors are exploiting a vulnerability patched in December 2024 against outdated DSM to encrypt data and extort ransom, naming no CVE and pointing to Synology-SA-24:20 (Synology, 2026-10-29), whose lead flaw, CVE-2024-10441, allows remote code execution without credentials (CVSS 9.8) (Synology PSIRT, 2024-11-05). The same day 360 identified the ransomware as C3RB3R, a Cerber variant, and named CVE-2026-13639 and CVE-2026-13684 as its entry point (translated from Chinese) (360, 2026-10-29). The accounts conflict and no source reconciles them. BleepingComputer says the name is borrowed from the 2016 Cerber ransomware-as-a-service operation and reports Shadowserver tracking over 380,000 internet-exposed Synology NAS (BleepingComputer, 2026-11-02).
Cited evidence
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Successful exploitation allows unauthenticated attackers to read and write arbitrary files, or disrupt NAS services via denial-of-service attacks.
The terse description of the flaws on Synology's advisory page is likely to quickly draw ransomware authors and other criminals, since exploitation is, according to Synology, very easy.
Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom.
The entry point of this round of attacks is two high-risk remote vulnerabilities, with CVE numbers CVE-2026-13639 and CVE-2026-13684 (translated from Chinese)
While Synology has yet to share which vulnerability is being exploited in these ongoing attacks
Updates1
Synology says threat actors are exploiting a vulnerability patched in December 2024 against devices on outdated DSM, in attacks that encrypt data and extort ransom, and points to Synology-SA-24:20 without naming a CVE (Synology, 2026-10-29). 360 identified the ransomware as C3RB3R, a Cerber variant, and named the two September flaws, CVE-2026-13639 and CVE-2026-13684, as the entry point (translated from Chinese) (360, 2026-10-29); BleepingComputer notes that Synology has not said which vulnerability is exploited (BleepingComputer, 2026-11-02). The exploited flaw is unresolved between the two advisories.
Sources8
Revision history
- Published 2026-09-22T0410Z-intel
- Update 2026-11-03T0256Z-intel
Synology says threat actors are exploiting a vulnerability patched in December 2024 to encrypt devices on outdated DSM and points to its advisory SA-24:20 without naming a CVE, while 360 identifies the C3RB3R ransomware and names the two September 2026 flaws, CVE-2026-13639 and CVE-2026-13684, as its entry point. The two accounts conflict, so no CVE is marked exploited.
Changed: title headline summary tags entities techniques cves sources evidence verification sourcing_note confidence classification actions body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.