NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksUpdated

Synology NAS devices hit by C3RB3R ransomware through unpatched DSM flaws

Ransomware is targeting Synology NAS storage devices running outdated DSM. Update to the latest DSM your model supports, enable automatic updates and keep the management interface off the public internet. Fixes are available.

What to do

Update your Synology NAS to the latest DSM supported by its model and enable automatic updates; ask whoever manages it to check the branch-specific fixes below. Remove public internet access to its management interface. Keep an offline backup disconnected from the NAS.

Check your devices
  • Synology DSM 7.4fixed in 7.4-90075 and later
  • Synology DSM 7.3fixed in 7.3.2-86009-4 and later
  • Synology DSM 7.2.2fixed in 7.2.2-72806-9 and later
  • Synology DSM 7.2.1fixed in 7.2.1-69057-12 and later
  • Synology DSM 7.2fixed in 7.2-64570-4 and later
  • Synology DSM 7.1fixed in 7.1.1-42962-7 and later
  • Synology DSM 6.2fixed in 6.2.4-25556-8 and later

What’s happening

Synology NAS owners at home and work face ransomware attacks against outdated DiskStation Manager (DSM), the software running their storage devices. Synology says attackers are exploiting a flaw patched in December 2024, but has not identified its CVE. Its linked advisory covers three flaws involving running code, reading files and writing files. Separately, Qihoo 360 attributes C3RB3R attacks it investigated to two different DSM flaws patched in September 2026. These accounts identify different vulnerabilities; Synology has not reconciled them publicly. Fixes are available for the affected DSM branches listed in both advisories. Owners should install the latest DSM supported by their model rather than rely only on the older minimum fixes.

What
Flaw
Affects
Synology NAS devices running DiskStation Manager (DSM)
Affected
SA-24:20: DSM 7.2.2 before 7.2.2-72806-1
SA-24:20: DSM 7.2.1 before 7.2.1-69057-6
SA-24:20: DSM 7.2 before 7.2-64570-4
SA-24:20: DSM 7.1 before 7.1.1-42962-7
SA-24:20: DSM 6.2 before 6.2.4-25556-8
SA-26:13: DSM 7.4 before 7.4-90075
SA-26:13: DSM 7.3 before 7.3.2-86009-4
SA-26:13: DSM 7.2.2 before 7.2.2-72806-9
SA-26:13: DSM 7.2.1 before 7.2.1-69057-12
Fixed in
SA-24:20: DSM 7.2.2-72806-1 or above
SA-24:20: DSM 7.2.1-69057-6 or above
SA-24:20: DSM 7.2-64570-4 or above
SA-24:20: DSM 7.1.1-42962-7 or above
SA-24:20: DSM 6.2.4-25556-8 or above
SA-26:13: DSM 7.4-90075 or above
SA-26:13: DSM 7.3.2-86009-4 or above
SA-26:13: DSM 7.2.2-72806-9 or above
SA-26:13: DSM 7.2.1-69057-12 or above
CVE
CVE-2024-10441, CVE-2024-50629, CVE-2024-10445, CVE-2026-13639, CVE-2026-13684
Since
29 Oct 2026

Timeline

  1. Update

    BleepingComputer updated its report with Synology's response: the company again directed it to SA-24:20 without naming the exploited flaw.

  2. Update

    Separately, Qihoo 360 attributed C3RB3R attacks it investigated to CVE-2026-13639 and CVE-2026-13684, patched in September 2026.

  3. Wider attacks

    Synology warned that attackers were exploiting a flaw patched in December 2024 to encrypt data and demand ransom. It linked SA-24:20 without identifying the exploited CVE.

  4. New fixFixed

    Synology released fixes for newer DSM flaws, including CVE-2026-13639 and CVE-2026-13684, across DSM 7.4, 7.3, 7.2.2 and 7.2.1.

  5. New fixFixed

    Synology added DSM 6.2 to advisory SA-24:20 and confirmed its update was available. The advisory now lists fixes for all five affected DSM branches.

Sources

  1. Synology-SA-24:20 DSM (PWN2OWN 2024)Synology · 28 Mar 2025
  2. Synology-SA-26:13 DSMSynology · 18 Sept 2026
  3. Synology urges users to update DSM following ransomware attacks on outdated DSM versionsSynology · 29 Oct 2026
  4. Cerber ransomware attacks on Synology NAS: incident warningQihoo 360 · 29 Oct 2026
  5. Synology warns of C3RB3R ransomware attacks targeting NAS devicesBleepingComputer · 3 Nov 2026
  6. Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM FlawThe Hacker News · 3 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS