DiskStation Manager (DSM) vulnerabilities | LiveThreat CVE Feed

Product

DiskStation Manager (DSM)

by Synology · last CVE Sep 18, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities30 In the news0 Timeline

Severity mix

Critical 7High 9Medium 11Low 3

Severity

All severities30 Critical7 High9 Medium11 Low3

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add DiskStation Manager (DSM) to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-40535	6.5	1%	Sep 18	An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10
CVE-2026-40532	6.5	0%	Sep 18	A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10
CVE-2026-4036	6.5	0%	Sep 18	An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10
CVE-2026-40534	5.4	0%	Sep 18	An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10
CVE-2026-40533	5.3	0%	Sep 18	An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10
CVE-2026-13635	5.3	0%	Sep 18	An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12
CVE-2026-13623	4.8	0%	Sep 18	An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12,… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12
CVE-2026-40537	4.3	0%	Sep 18	A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10
CVE-2026-40536	4.3	0%	Sep 18	An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10
CVE-2026-40531	4.3	0%	Sep 18	An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10
CVE-2022-27622	4.3	1%	Oct 25	Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access… Affected: before 7.1-42661