# CVE-2026-13639

Insufficient entropy in Synology DSM login enables remote file read/write and DoS.

- Page: https://www.vulneraibility.com/cve/CVE-2026-13639
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.66% (percentile 51.8)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-18)
- Weakness: CWE-331
- Published: 2026-09-18

## Affected versions

- Synology DiskStation Manager (DSM): affected >= 7.4 and < 7.4-90075; >= 7.3.2 and < 7.3.2-86009-4; >= 7.2.2 and < 7.2.2-72806-9; >= 7.2.1 and < 7.2.1-69057-12; < 7.2.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote attackers can read/write arbitrary files and cause denial-of-service via weak entropy in DSM login, enabling data theft, device compromise, or service outage.

## Action

Immediate action required

## Recommendation

Upgrade DSM to the fixed versions immediately and restrict network access until patched.

## References

- [other] https://www.synology.com/en-global/security/advisory/Synology_SA_26_13

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.