CVE-2026-13639 Synology: Insufficient Entropy in Login

CVE-2026-13639 is an insufficient entropy vulnerability in the login logic of Synology DiskStation Manager (DSM). The flaw allows remote attackers to read or write arbitrary files on the device and conduct denial-of-service attacks, compromising confidentiality, integrity, and availability of stored data on affected NAS. The CVSS 9.8 score reflects critical impact: file access may extend to all shares and backups.

The vulnerability is critical (CVSS 9.8) since September 18, 2026. If and when Synology released patches is not reported. Signals on X indicate the CVE is part of combined exploitation chains actively exploited: a post today mentions it alongside two other critical CVEs. No public exploit repositories are reported on GitHub; the attack signal remains on social but requires defenders' attention.

System administrators must immediately verify DSM version on all production Synology NAS and apply fixes to vulnerable versions (7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 or later) if available from vendor. In parallel monitor remote access logs, restrict management interface exposure to trusted networks, and verify data integrity to exclude unauthorized access. Maximum priority: CVSS 9.8 on business-critical product.