DiskStation Manager (DSM) vulnerabilities | LiveThreat CVE Feed

Product

DiskStation Manager (DSM)

by Synology · last CVE Sep 18, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities30 In the news0 Timeline

Severity mix

Critical 7High 9Medium 11Low 3

Severity

All severities30 Critical7 High9 Medium11 Low3

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add DiskStation Manager (DSM) to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-13639	9.8	1%	Sep 18	An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12
CVE-2026-13684	9.8	1%	Sep 18	An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12
CVE-2025-13392	9.8	1%	May 27	Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not… Affected: 7.3 before 7.3.1-86003-1; 7.2.2 before 7.2.2-72806-5
CVE-2022-27624	9.8	2%	Oct 20	A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2
CVE-2022-27625	9.8	2%	Oct 20	A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2
CVE-2024-45538	9.6	0%	Dec 4	Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller… Affected: 7.2.2 before 7.2.2-72806; 7.2.1 before 7.2.1-69057-2
CVE-2022-27623	9.1	1%	Oct 25	Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read… Affected: before 7.1-42661