Is CVE-2026-9491 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9491 being exploited in the wild.

How severe is CVE-2026-9491?

Medium severity, with a CVSS score of 4.3, published 28 August 2026.

Which products and versions are affected?

Synology Chat Server before 2.4.5-22148.

Is there a fix for CVE-2026-9491?

A patch was published on 2026-05-26: Fixed in version 2.4.5-22148 or above Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9491 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-9491?

Check whether you run Synology Chat Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9491: Synology Chat Server SSRF in webhook

CVE-2026-9491 · Severity: medium · CVSS 4.3 · Published 2026-08-28

Synology Chat Server contains a server-side request forgery vulnerability in its webhook functionality that allows authenticated users to access non-sensitive internal information. An attacker with valid credentials can exploit this to probe internal network resources and bypass security controls designed to restrict outbound requests.

Technologies: Synology Chat Server. Vendors: Synology.

Quick answers

Is CVE-2026-9491 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9491 being exploited in the wild.
How severe is CVE-2026-9491?: Medium severity, with a CVSS score of 4.3, published 28 August 2026.
Which products and versions are affected?: Synology Chat Server before 2.4.5-22148.
Is there a fix for CVE-2026-9491?: A patch was published on 2026-05-26: Fixed in version 2.4.5-22148 or above Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9491 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-9491?: Check whether you run Synology Chat Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a server-side request forgery (SSRF) vulnerability (CWE-918) in the webhook component of Synology Chat Server prior to version 2.4.5-22148. The vulnerability requires authentication and network access but no user interaction. An authenticated remote attacker can manipulate webhook requests to access or retrieve non-sensitive information from internal systems that would normally be restricted. The vulnerability has been patched in version 2.4.5-22148 and later.

Affected products

Synology Chat Server before 2.4.5-22148

Timeline

2026-05-26: disclosed: Initial public release of Synology-SA-26:10
2026-08-28: disclosed: Vulnerability details disclosed
2026-05-26: patched: Fixed in version 2.4.5-22148 or above

References

https://www.synology.com/en-global/security/advisory/Synology_SA_26_10

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.