For: people who use Synology NAS devices (DiskStation, BeeStation and similar) at home, in an office, in a shop or in a small business, and people who look after them. This article is based on Synology's announcement and security advisory. It does not cover attack steps or exploit code.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who use Synology NAS devices (DiskStation, BeeStation and similar) at home, in an office, in a shop or in a small business, and people who look after them.
- Confirmed so farSee the table ↓
- Attacks on outdated DSM
- Aim of the attacks
- Fixed releases
1 more
- Workaround
- Not yet confirmed
- Which of the three SA-24:20 vulnerabilities is being exploited (Synology does not say)
- The scale of the attacks and the number of victims
- Which DSM versions were compromised
2 more
- Synology's response to another company naming a different vulnerability
- Any link between SA-26:13 and these attacks (Synology does not make one)
- What to do nowSee the steps ↓
- Check your DSM version
- Update to the fixed release or later
- Turn on automatic updates
4 more
- Do not expose the management interface to the internet
- Keep a backup the NAS cannot overwrite
- Check for unfamiliar administrator accounts
- If the model is too old to update, disconnect or replace it
- Where to verify (source)All sources ↓
- Synology, "Synology urges users to update DSM following ransomware attacks on outdated DSM versions" (October 29, 2026)
- Last checked
- As of November 3, 2026 (JST)
Follow-up plans and what we checked
Synology issued a press release on October 29 confirming the attacks and urging users to update. On November 3 this site checked Synology's English and Japanese press releases, SA-24:20 and SA-26:13. As of November 3, no later update to the press release was found.
What to do today
Check your DSM version
Log in to DSM and open Control Panel > Update & Restore to see your current version. If a newer version is offered, you should install it. Synology urges all users running vulnerable versions to update immediately.
Update to the fixed release or later
SA-24:20 lists these fixed releases: 7.2.2-72806-1 or above for DSM 7.2.2, 7.2.1-69057-6 for 7.2.1, 7.2-64570-4 for 7.2, 7.1.1-42962-7 for 7.1 and 6.2.4-25556-8 for 6.2. This is the minimum. This site also recommends going to the fixed release in SA-26:13 (September 2026): 7.4-90075 or above for DSM 7.4, 7.3.2-86009-4 for 7.3, 7.2.2-72806-9 for 7.2.2 and 7.2.1-69057-12 for 7.2.1. If you are on 7.2.2, that means -9, not -1. DSM 7.2, 7.1 and 6.2 are not in SA-26:13: the SA-24:20 fix is the minimum, so move to a newer supported DSM if the model allows, and otherwise disconnect it from the internet or replace it. Back up anything important before you update.
Turn on automatic updates
Synology recommends enabling automatic updates to keep DSM current. You can check the setting on the same screen.
Do not expose the management interface to the internet
Check your router for port forwarding to DSM's management ports (5000 and 5001 by default). If you need access from outside, use a VPN rather than exposing the NAS directly (defending VPN devices). This is this site's recommendation; it is not in Synology's announcement.
Keep a backup the NAS cannot overwrite
Snapshots stored on the NAS can be lost together with it if the NAS is taken over. Use Hyper Backup or similar to save to a separate device or cloud destination, in a form the NAS cannot rewrite (backup and recovery essentials). Test a restore once.
Check for unfamiliar administrator accounts
Open Control Panel > User & Group and look at the accounts with administrator rights. If you find one you do not recognise, treat it as a possible compromise and contact Synology support or an incident-response specialist, before and after updating (this site's judgment). Turn on two-factor authentication for administrator accounts.
If the model is too old to update, disconnect or replace it
A model that cannot reach a fixed release from SA-24:20, or that the manufacturer no longer supports, should be taken off the internet or replaced (this site's judgment).
1. Update DSM
To the fixed release or later, with auto-update on (Synology's call)
2. Keep it off the internet
No public management interface; VPN from outside (this site's recommendation)
3. Keep a copy elsewhere
A backup the NAS cannot rewrite (this site's recommendation)
What Synology announced
- Headline
- "Synology urges users to update DSM following ransomware attacks on outdated DSM versions"
- The attacks
- Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. The attacks aim to encrypt data and extort a ransom
- Call to action
- Synology strongly urges all users running vulnerable versions to update DSM immediately and recommends enabling automatic updates
- Reference
- It points to Synology-SA-24:20 for details
- Not stated
- The announcement gives no CVE number, ransomware name, number of victims or attacker
"Patched in December 2024" fits SA-24:20's revision history. The advisory was published on November 5, 2024, and its December 5, 2024 revision added the DSM 6.2 update (this site's reading of the two; Synology does not link them).
- Status
- Severity Critical, status Resolved, mitigation None. Published November 5, 2024; last updated March 28, 2025
- CVE-2024-10441
- An output-encoding flaw in the system plugin daemon. Remote attackers can execute arbitrary code. CVSS v3 9.8 (Critical). The description also lists BeeStation OS (BSM) before 1.1-65374
- CVE-2024-50629
- An output-encoding flaw in webapi. Remote attackers can read limited files. Moderate (5.3). BSM before 1.1-65374 is also listed
- CVE-2024-10445
- Improper certificate validation in the update functionality. Limited files can be written. The attacker must be on the adjacent network (CVSS AV:A). Moderate (4.3). BSM before 1.1-65374 is also listed
- Which is exploited
- Synology does not say which of the three is being exploited
Fixed releases (from SA-24:20)
| DSM branch | Severity | Fixed release |
|---|---|---|
| DSM 7.2.2 | Critical | 7.2.2-72806-1 or above |
| DSM 7.2.1 | Critical | 7.2.1-69057-6 or above |
| DSM 7.2 | Critical | 7.2-64570-4 or above |
| DSM 7.1 | Critical | 7.1.1-42962-7 or above |
| DSM 6.2 | Moderate | 6.2.4-25556-8 or above |
The versions listed in each CVE's description are not identical. The CVE-2024-10441 description lists DSM 7.2 and later builds, not 7.1 or 6.2. Since the exploited vulnerability has not been identified, moving to your branch's fixed release or later is the safe course. If you use a BeeStation, update BSM to 1.1-65374 or later (from the advisory's CVE descriptions; check the advisory for the exact BSM fixed-release wording). If your branch is not in the table, check Synology's advisory page.
Press reports and what is not known
According to press reports (November 2), another security company points to a DSM vulnerability different from the ones in SA-24:20. Synology does not address this, and the discrepancy is unresolved. This site does not go beyond Synology's announcement on which vulnerability is being used.
- Status
- Severity Critical, status Resolved, no mitigation. Eight CVEs in total
- Main content
- Two Critical (CVSS 9.8) unauthenticated remote file read/write issues: CVE-2026-13684 (SCGI) and CVE-2026-13639 (login logic)
- Link to the ransomware attacks
- Synology does not connect SA-26:13 to these ransomware attacks
Latest fixed releases (from SA-26:13)
| DSM branch | Fixed release |
|---|---|
| DSM 7.4 | 7.4-90075 or above |
| DSM 7.3 | 7.3.2-86009-4 or above |
| DSM 7.2.2 | 7.2.2-72806-9 or above |
| DSM 7.2.1 | 7.2.1-69057-12 or above |
SA-26:13 is a separate advisory and Synology does not tie it to these attacks. But more serious DSM flaws have since been found and fixed, so this site recommends going to the SA-26:13 fixed release or later rather than stopping at the SA-24:20 one (this site's judgment). DSM 7.2, 7.1 and 6.2 are not in SA-26:13. For those branches the SA-24:20 fix is the minimum; move to a newer supported DSM if the model allows, and otherwise disconnect it from the internet or replace it (this site's recommendation).
Timeline
Nov 5, 2024
Synology publishes SA-24:20, "DSM (PWN2OWN 2024)".Dec 5, 2024
SA-24:20 is revised and the DSM 6.2 update is added (revision history).Mar 28, 2025
Last update to SA-24:20.Sep 18, 2026
Synology publishes SA-26:13, "DSM" (Critical).Oct 29, 2026
Synology says it has identified ransomware attacks on outdated DSM and urges users to update.Nov 3, 2026
This site checks the English and Japanese press releases, SA-24:20 and SA-26:13.
What is known and what is not
| Item | What Synology says | Status |
|---|---|---|
| Attacks on outdated DSM | Synology says it identified the attackers (October 29) | Confirmed |
| Aim of the attacks | Encrypt data and extort a ransom (Synology) | Confirmed |
| The exploited vulnerability | "A vulnerability patched in December 2024"; no CVE number given | As worded by Synology (not identified) |
| Which of the three SA-24:20 CVEs | Not stated | Not disclosed |
| Fixed releases | Per-branch list in SA-24:20 | Confirmed |
| Workaround | SA-24:20 mitigation: None | Confirmed (none) |
| Number of victims, versions compromised | Not stated | Not disclosed |
| Ransomware name, attacker | Not in Synology's announcement | Not disclosed |
| A different vulnerability named by another company | Press reports only; Synology does not address it | Unconfirmed (press reports only) |
Sources
Checked on November 3, 2026 (JST).
- Synology, "Synology urges users to update DSM following ransomware attacks on outdated DSM versions" (October 29, 2026) — synology.com
- Synology, Japanese version of the press release — synology.com (Japanese)
- Synology, "Synology-SA-26:13" security advisory — synology.com
- Synology, "Synology-SA-24:20" security advisory — synology.com
Update history
2026-11-03: First version. Based on Synology's press release (English and Japanese) and SA-24:20.
Read next
- How to build backups: Backup essentials: the 3-2-1 rule and a recovery plan that survives ransomware
- Defending exposed devices: VPN devices are a leading ransomware entry point
- Deciding what to patch first: How to prioritise CVEs (CVSS, EPSS, KEV)
- Response steps: What to do when a vulnerability is announced