# CVE-2026-40538: Synology DiskStation Manager brute-force attack via insufficient rate limiting

Source: https://junglewise.ai/threats/cve-2026-40538-synology-diskstation-manager-brute-force-attack-via-insufficient  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-40538 · Severity: low · CVSS 3.7 · Published 2026-09-18

Synology DiskStation Manager (DSM) is the operating system for Synology NAS devices, which are commonly used in businesses for data storage and backup. An insufficiently protected login mechanism allows attackers to conduct brute-force attacks without proper rate limiting, potentially enabling unauthorized access to stored data and system configuration. This vulnerability affects DSM versions 7.2.1, 7.2.2, and 7.3.2 before specific patch levels.

Technologies: [Synology DiskStation Manager](https://junglewise.ai/threats/technologies/diskstation-manager). Vendors: [Synology](https://junglewise.ai/threats/vendors/synology).

## Quick answers

**Is CVE-2026-40538 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40538 being exploited in the wild.

**How severe is CVE-2026-40538?** Low severity, with a CVSS score of 3.7, published 18 September 2026.

**Which products and versions are affected?** Synology DiskStation Manager 7.2.1 before 69057-10, 7.2.2 before 72806-7, 7.3.2 before 86009-2.

**Is there a fix for CVE-2026-40538?** A patch was published on 2026-04-15: Patches released for DSM 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40538 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40538?** Check whether you run Synology DiskStation Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability (CWE-307) involves improper restriction of excessive authentication attempts in the Auto block mechanism of Synology DSM. The vulnerability allows remote attackers to conduct brute-force attacks against login credentials with insufficient account lockout or rate-limiting protection. The attack requires no authentication and can be performed over the network, though with moderate complexity. An attacker can exploit this to read limited files or potentially gain unauthorized access. Patches are available in DSM 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 or later.

## Affected products

- Synology DiskStation Manager 7.2.1 before 69057-10, 7.2.2 before 72806-7, 7.3.2 before 86009-2

## Timeline

- 2026-04-15: disclosed
- 2026-04-15: patched: Patches released for DSM 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 or later

## References

- [https://www.synology.com/en-global/security/advisory/Synology_SA_26_06](https://www.synology.com/en-global/security/advisory/Synology_SA_26_06)

## Related threats

- [Synology DiskStation Manager sensitive information disclosure in API framework](https://junglewise.ai/threats/cve-2026-87801-an-insertion-of-sensitive-information-into-sent-data)
- [Synology DiskStation Manager SNMP API CRLF injection](https://junglewise.ai/threats/cve-2026-86343-an-improper-neutralization-of-crlf-sequences-vulnerability-in-the)
- [Synology DiskStation Manager authentication bypass in rsync](https://junglewise.ai/threats/cve-2026-85101-an-authentication-bypass-using-an-alternate-path-or-channel)
- [Synology DiskStation Manager reachable assertion denial-of-service](https://junglewise.ai/threats/cve-2026-85098-a-reachable-assertion-vulnerability-in-the-synoscgi-in-synology)
- [Synology DiskStation Manager SQL injection in User API](https://junglewise.ai/threats/cve-2026-81584-an-improper-neutralization-of-special-elements-used-in-an-sql)