2026-11-03
Ransomware attacks on Synology DSM: outdated versions targeted through a flaw fixed in December 2024, what to update and check today (SA-24:20)
On October 29, 2026, Synology said it had identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM, with the aim of encrypting data and extorting a ransom. It strongly urges everyone on vulnerable versions to update DSM immediately and recommends turning on automatic updates. It points to Synology-SA-24:20, whose fixed releases are 7.2.2-72806-1 or above for DSM 7.2.2, 7.2.1-69057-6 for 7.2.1, 7.2-64570-4 for 7.2, 7.1.1-42962-7 for 7.1 and 6.2.4-25556-8 for 6.2. The advisory lists three CVEs, and Synology does not say which of them is being exploited. It has not published the number of victims or any attacker name. This site's conclusion: check your DSM version today, update to the fixed release or later, and do not expose the DSM management interface to the internet. Keep a backup that is separate from the NAS and cannot be overwritten from it.