Multiple vulnerabilities in Synology DSM (September 21, 2026)

Risks - Compromise of data integrity - Compromise of data confidentiality - Circumvention of security policy - Remote denial of service - Remote arbitrary code execution - Remote code injection (XSS) - SQL Injection (SQLi) - Not specified by the vendor Affected Systems - DSM versions prior to 7.2.1-69057-12 - DSM versions prior to 7.2.2-72806-9 - DSM versions prior to 7.3.2-86009-4 - DSM versions 7.4.x prior to 7.4-90075 Summary Multiple vulnerabilities have been discovered in Synology DSM. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service, and data confidentiality breaches. Solutions Refer to the vendor's security bulletin for obtaining patches (see Documentation section). Documentation - Synology Security Bulletin Synology_SA_26_13 of September 18, 2026 https://www.synology.com/en-global/security/advisory/Synology_SA_26_13 - CVE Reference CVE-2026-13623 https://www.cve.org/CVERecord?id=CVE-2026-13623 - CVE Reference CVE-2026-13635 https://www.cve.org/CVERecord?id=CVE-2026-13635 - CVE Reference CVE-2026-13639 https://www.cve.org/CVERecord?id=CVE-2026-13639 - CVE Reference CVE-2026-13666 https://www.cve.org/CVERecord?id=CVE-2026-13666 - CVE Reference CVE-2026-13673 https://www.cve.org/CVERecord?id=CVE-2026-13673 - CVE Reference CVE-2026-13683 https://www.cve.org/CVERecord?id=CVE-2026-13683 - CVE Reference CVE-2026-13684 https://www.cve.org/CVERecord?id=CVE-2026-13684 - CVE Reference CVE-2026-6205 https://www.cve.org/CVERecord?id=CVE-2026-6205