DiskStation Manager (DSM) vulnerabilities | LiveThreat CVE Feed

Product

DiskStation Manager (DSM)

by Synology · last CVE Sep 18, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities27 In the news0 Timeline

Severity mix

Critical 6High 7Medium 11Low 3

Severity

All severities27 Critical6 High7 Medium11 Low3

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add DiskStation Manager (DSM) to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-13673	8.8	0%	Sep 18	An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12
CVE-2026-6205	8.1	1%	Sep 18	An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12
CVE-2022-27626	8.1	1%	Oct 20	A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of… Affected: before 7.1.1-42962-2
CVE-2026-40530	8.0	0%	Sep 18	An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10
CVE-2022-3576	7.5	1%	Oct 20	A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2
CVE-2022-27616	7.2	2%	Aug 3	Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before… Affected: before 7.0.1-42218-3
CVE-2026-40539	7.1	0%	Sep 18	An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10