# CVE-2026-13684: Synology DiskStation Manager improper encoding in SCGI

Source: https://junglewise.ai/threats/cve-2026-13684-synology-diskstation-manager-improper-encoding-in-scgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-13684 · Severity: critical · CVSS 9.8 · Published 2026-09-18

Synology DiskStation Manager is a centralized storage and file management system used in Synology NAS devices. An improper encoding flaw in the SCGI component allows remote attackers without authentication to read or write arbitrary files on affected systems and cause service disruptions, potentially exposing sensitive data or enabling ransomware deployment.

Technologies: [Synology DiskStation Manager](https://junglewise.ai/threats/technologies/diskstation-manager). Vendors: [Synology](https://junglewise.ai/threats/vendors/synology).

## Quick answers

**Is CVE-2026-13684 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13684 being exploited in the wild.

**How severe is CVE-2026-13684?** Critical severity, with a CVSS score of 9.8, published 18 September 2026.

**Which products and versions are affected?** Synology DiskStation Manager 7.2.1 before 7.2.1-69057-12, 7.2.2 before 7.2.2-72806-9, 7.3.2 before 7.3.2-86009-4, 7.4 before 7.4-90075.

**Is there a fix for CVE-2026-13684?** A patch was published on 2026-09-18: Patches released for DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 or above Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13684 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-13684?** Check whether you run Synology DiskStation Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-13684 is an improper encoding or escaping of output vulnerability (CWE-116) in the SCGI (Simple Common Gateway Interface) handler of Synology DSM. The vulnerability is network-accessible and requires no authentication, user interaction, or special privileges. Remote attackers can exploit this flaw to read or write arbitrary files and conduct denial-of-service attacks. Patches are available for DSM 7.2.1, 7.2.2, 7.3.2, and 7.4 as specified in the advisory.

## Affected products

- Synology DiskStation Manager 7.2.1 before 7.2.1-69057-12, 7.2.2 before 7.2.2-72806-9, 7.3.2 before 7.3.2-86009-4, 7.4 before 7.4-90075

## Timeline

- 2026-09-18: disclosed: Vulnerability disclosed by Synology and published on NVD
- 2026-09-18: patched: Patches released for DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 or above

## References

- [https://www.synology.com/en-global/security/advisory/Synology_SA_26_13](https://www.synology.com/en-global/security/advisory/Synology_SA_26_13)

## Related threats

- [Synology DiskStation Manager sensitive information disclosure in API framework](https://junglewise.ai/threats/cve-2026-87801-an-insertion-of-sensitive-information-into-sent-data)
- [Synology DiskStation Manager SNMP API CRLF injection](https://junglewise.ai/threats/cve-2026-86343-an-improper-neutralization-of-crlf-sequences-vulnerability-in-the)
- [Synology DiskStation Manager authentication bypass in rsync](https://junglewise.ai/threats/cve-2026-85101-an-authentication-bypass-using-an-alternate-path-or-channel)
- [Synology DiskStation Manager reachable assertion denial-of-service](https://junglewise.ai/threats/cve-2026-85098-a-reachable-assertion-vulnerability-in-the-synoscgi-in-synology)
- [Synology DiskStation Manager SQL injection in User API](https://junglewise.ai/threats/cve-2026-81584-an-improper-neutralization-of-special-elements-used-in-an-sql)