CVE-2026-13684: arbitrary file read/write in Synology DSM

CVE-2026-13684 is an improper encoding/escaping of output vulnerability in the SCGI component of Synology DiskStation Manager (DSM). The flaw allows remote attackers to read and write arbitrary files on the system and launch denial-of-service attacks. It affects IT administrators, infrastructure managers, and small-to-medium enterprises using Synology NAS as a centralized repository for critical data.

The CVSS score is 9.8 and the vulnerability is declared critical. It impacts all versions of Synology DSM prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. A GitHub signal from November 8, 2026 confirms public repositories declare containing exploits, indicating the vulnerability is known and discussed in security communities. Official patches are available from Synology.

Defenders must immediately update all Synology DSM NAS devices to the correct versions. Verify the current version via the Control Panel web interface (Info). If an update is not immediately possible, isolate the system from public networks until the patch is available. Check access logs for suspicious activity and filesystem anomalies.

Do not download exploits from public repositories; the absolute priority is applying the patch. If the system shows signs of compromise (unusual files, alterations), involve your incident response team for forensic analysis and recovery.