Quick answers
- Is CVE-2026-13684 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13684 being exploited in the wild.
- How severe is CVE-2026-13684?
- Critical severity, with a CVSS score of 9.8, published 18 September 2026.
- Which products and versions are affected?
- Synology DiskStation Manager 7.2.1 before 7.2.1-69057-12, 7.2.2 before 7.2.2-72806-9, 7.3.2 before 7.3.2-86009-4, 7.4 before 7.4-90075.
- Is there a fix for CVE-2026-13684?
- A patch was published on 2026-09-18: Patches released for DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 or above Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13684 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-13684?
- Check whether you run Synology DiskStation Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-13684 is an improper encoding or escaping of output vulnerability (CWE-116) in the SCGI (Simple Common Gateway Interface) handler of Synology DSM. The vulnerability is network-accessible and requires no authentication, user interaction, or special privileges. Remote attackers can exploit this flaw to read or write arbitrary files and conduct denial-of-service attacks. Patches are available for DSM 7.2.1, 7.2.2, 7.3.2, and 7.4 as specified in the advisory.
Affected products
- Synology DiskStation Manager 7.2.1 before 7.2.1-69057-12, 7.2.2 before 7.2.2-72806-9, 7.3.2 before 7.3.2-86009-4, 7.4 before 7.4-90075
Timeline
- 2026-09-18: disclosed: Vulnerability disclosed by Synology and published on NVD
- 2026-09-18: patched: Patches released for DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 or above