# CVE-2026-13684

Critical remote arbitrary file read/write and DoS in Synology DSM via SCGI

- Page: https://www.vulneraibility.com/cve/CVE-2026-13684
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.60% (percentile 48.8)
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept (first 2026-10-30)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-18)
- Weakness: CWE-116
- Published: 2026-09-18

## Affected versions

- Synology DiskStation Manager (DSM): affected >= 7.4 and < 7.4-90075; >= 7.3.2 and < 7.3.2-86009-4; >= 7.2.2 and < 7.2.2-72806-9; >= 7.2.1 and < 7.2.1-69057-12; < 7.2.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote attackers can read/write arbitrary files and cause DoS via SCGI, enabling data theft, tampering, and potential follow-on compromise.

## Action

Immediate action required

## Recommendation

Apply Synology DSM updates to the fixed versions immediately; validate integrity and rotate credentials.

## References

- [other] https://www.synology.com/en-global/security/advisory/Synology_SA_26_13

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.