CVE-2026-13684

What's affected. From Synology-SA-26:13, both CVEs are fixed in these releases.

• DSM 7.4: "Upgrade to 7.4-90075 or above."
• DSM 7.3: "Upgrade to 7.3.2-86009-4 or above."
• DSM 7.2.2: "Upgrade to 7.2.2-72806-9 or above."
• DSM 7.2.1: "Upgrade to 7.2.1-69057-12 or above."
• Older branches: Synology's advisory lists no versions earlier than 7.2.1, and Synology's CVE record marks them "unknown." CUHK ITSC says "Devices on older DSM branches should also be checked against Synology-SA-24:20."

The test. Synology's CVSS vector for both CVEs is PR:N, meaning no login is required, and its description says "remote attackers," unlike other bugs in the same advisory that it limits to "remote authenticated users."

1. Check the DSM version. In DSM, open Control Panel > Info Center and read the DSM version. Below the fixed build for your branch means vulnerable.
2. Check whether the DSM web interface faces the internet. Synology documents DSM on ports 5000 (HTTP) and 5001 (HTTPS). From outside your network, test whether the NAS's public IP or DDNS name answers on 5000, 5001 or any custom DSM port.
3. Check router port forwarding and UPnP. Look at Control Panel > External Access > Router Configuration. Synology says rules there "make your Synology NAS device accessible over the Internet," and DSM can set them up on a UPnP router. Check the router itself for forwards to the NAS too.
4. Check QuickConnect. Look at Control Panel > External Access > QuickConnect. Synology says QuickConnect "allows client applications to connect to your Synology NAS via the Internet without the hassle of setting up port forwarding rules." If it is on, check under Advanced Settings whether the relay service is enabled.
5. Check for a reverse proxy. Our reading (Tuskira): if DSM is published through a reverse proxy, on the NAS or upstream (a load balancer, tunnel or web proxy), a proxied DSM login page counts as exposed.
6. Check the DSM firewall. Look at Control Panel > Security > Firewall to see whether it is on and whether rules allow 5000 and 5001 from any source.

Our reading (Tuskira): a NAS below the fixed build is reachable by anyone who can reach its DSM web interface. Port forwarding, UPnP, QuickConnect or a reverse proxy widens that from your LAN to the internet.

Companion: CVE-2026-13639. Synology describes it as "an insufficient entropy vulnerability in login logic" that "allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks." Same 9.8 score, same fixed builds, same checks.

Exploitation, as reported. Qihoo 360, on October 29, writes "本轮攻击的切入点是两个高危远程漏洞，CVE编号分别为CVE-2026-13639和CVE-2026-13684" (Tuskira's translation: "The entry point of this round of attacks is two high-risk remote vulnerabilities, CVE-2026-13639 and CVE-2026-13684"), and says the ransomware is C3RB3R, a variant of the Cerber family. CUHK ITSC says "The threat actors reportedly exploit CVE-2026-13639 and CVE-2026-13684." Synology's own statement the same day says it "has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM" and points to Synology-SA-24:20. Synology has not publicly linked either CVE to the attacks.

Synology's advisory says "Mitigation: None." These come from responders, and each works only under the condition at the end of its line.

• Delivery. "Remove public exposure of DSM management services and use trusted networks or a secured VPN" (CUHK ITSC). Qihoo 360 also advises not mapping NAS management ports to the internet and using the vendor's relay service or a VPN. This only helps if no port forward, UPnP rule, QuickConnect path or reverse proxy still reaches DSM.
• Delivery. Turn on the DSM firewall, allow only the ports you need and limit management access to trusted IPs (Qihoo 360). This only helps if attackers can't reach DSM from an allowed address.
• Exploitation. Disable the default admin account, use strong passwords and turn on two-step verification and auto block (Qihoo 360). Neither Synology nor Qihoo 360 says exploitation needs a login, so treat this as hardening, not a block.
• Blast radius. Turn on shared folder snapshots with tamper protection and keep at least one offline backup disconnected from the NAS (Qihoo 360; CUHK ITSC advises "isolated backups and protected snapshots"). This only limits data loss if the backup can't be reached from the NAS when encryption runs.
• Blast radius. Remove idle sharing links and unused packages and services (Qihoo 360). This only helps if the removed services were reachable.

Updating DSM to the fixed build for your branch is the only fix.

Synology has published no indicators for these CVEs. These are from responders, for the C3RB3R ransomware, not for the exploitation step itself.

• .L0CK3D, the encrypted-file extension (with a zero), per CUHK ITSC and Qihoo 360.
• read-me3.txt, the ransom note filename, per CUHK ITSC.
• MD5 a1375e0f82ae86df528876c049b5a23c, a reported sample, per CUHK ITSC and Qihoo 360.
• c3rb3rpwdyq7bzofesaet7g3vrvnu7g26qfz3skqwseykudiodkwoqid[.]onion, the Tor payment site in the ransom note, per CUHK ITSC.

CUHK ITSC advises "Monitor unusual logins, bulk file changes and listed indicators." Qihoo 360 advises checking Log Center for unusual logins, bulk file changes and suspicious extensions, and disconnecting the NAS right away if any appear.

If you patched late. CUHK ITSC: "Patching does not remove an existing compromise." Check for the indicators above. CUHK ITSC: "If suspicious activity is detected, isolate the NAS and preserve relevant evidence before rebuilding. Rotate affected credentials from a clean system." No source has published a way to spot exploitation before files are encrypted, so finding none of these indicators does not prove the NAS wasn't accessed.

Am I exposed to CVE-2026-13684?

Yes, if a Synology NAS runs DSM below 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12 (by branch) and an attacker can reach its DSM web interface. Check the version in Control Panel > Info Center, then check port forwarding, UPnP, QuickConnect and any reverse proxy.

Is CVE-2026-13684 being exploited?

Qihoo 360 reports it, with CVE-2026-13639, as the entry point for C3RB3R ransomware. Synology disputes the link and says the attacks use a vulnerability it patched in December 2024 (Synology-SA-24:20). It is not on CISA's KEV as of November 4, 2026.

Is there a patch?

Yes. Synology-SA-26:13 (September 18, 2026) fixes both CVEs in DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12 or above. Synology lists no fix for branches older than 7.2.1.

How do I mitigate CVE-2026-13684 without patching?

Synology lists no mitigation. Responders advise taking DSM off the internet, limiting access to trusted IPs or a VPN, and keeping offline backups. These reduce exposure but are not a fix.

Nov 4, 2026. First published. Reported by Qihoo 360 as the C3RB3R ransomware entry point; Synology points to an older bug; not on CISA KEV.

• Synology-SA-26:13 DSM (Sep 18, 2026)
• Synology statement (Oct 29, 2026)
• Qihoo 360, C3RB3R ransomware targeting Synology NAS (Chinese, Oct 29, 2026)
• CUHK ITSC alert (Oct 30, 2026)
• CCB Belgium advisory (did not load for us)
• NIST NVD: CVE-2026-13684 and CVE-2026-13639 (Synology's CNA record; checked Nov 4)
• Synology Knowledge Center: network ports, QuickConnect, Router Configuration, Firewall
• CISA Known Exploited Vulnerabilities catalog (checked Nov 4)