CVE-2026-13635: Synology DSM Information Disclosure Flaw

CVE-2026-13635 Overview

CVE-2026-13635 is an improper encoding or escaping of output vulnerability [CWE-116] in the Auth API of Synology DiskStation Manager (DSM). The flaw allows remote, unauthenticated attackers to obtain non-sensitive information from affected network-attached storage (NAS) devices over the network. Synology disclosed the issue in Security Advisory SA-26-13 and released fixed builds across the DSM 7.x product line.

Critical Impact
Unauthenticated remote attackers can retrieve non-sensitive information from the DSM Auth API due to improper output encoding, aiding reconnaissance against exposed NAS appliances.

Affected Products

Synology DiskStation Manager (DSM) versions prior to 7.2.1-69057-12
Synology DiskStation Manager (DSM) versions prior to 7.2.2-72806-9
Synology DiskStation Manager (DSM) versions prior to 7.3.2-86009-4 and 7.4-90075

Discovery Timeline

2026-09-18 - CVE-2026-13635 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-13635

Vulnerability Analysis

The vulnerability resides in the Auth API component of Synology DSM, the operating system that powers Synology NAS appliances. DSM fails to properly encode or escape data returned by the Auth API endpoint. As a result, the response contains data that should have been neutralized before being emitted to the client.

The issue is categorized under CWE-116: Improper Encoding or Escaping of Output. Exploitation impacts confidentiality only. Integrity and availability are not affected. The advisory limits the exposed data to non-sensitive information, which typically supports reconnaissance rather than direct compromise.

Root Cause

The Auth API path in DSM does not apply correct output encoding when generating responses. When downstream components or the client parse the response, the unescaped content is interpreted in a context that reveals information the API did not intend to expose. The absence of consistent output neutralization is a canonical CWE-116 pattern.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted requests to the DSM Auth API and parses the improperly encoded response to extract information. Exposed DSM management interfaces reachable from the internet are the highest-risk deployment scenario. Refer to the Synology Security Advisory SA-26-13 for vendor-supplied technical details.

Detection Methods for CVE-2026-13635

Indicators of Compromise

Unusual volumes of unauthenticated HTTP/HTTPS requests to DSM Auth API endpoints from a single source.
Requests targeting DSM login and authentication paths from IP addresses outside expected administrative ranges.
Responses from DSM containing unexpected fields or verbose content returned to unauthenticated callers.

Detection Strategies

Inspect DSM web server logs for repeated, anonymous access patterns against the Auth API.
Compare running DSM build numbers against the fixed versions listed in Synology SA-26-13 to identify exposed appliances.
Deploy web application firewall (WAF) rules that flag anomalous Auth API responses larger than baseline sizes.

Monitoring Recommendations

Forward DSM system, connection, and web logs to a centralized SIEM for correlation with edge firewall telemetry.
Alert on any external access to DSM management ports (5000/tcp, 5001/tcp) that bypasses VPN or reverse proxy controls.
Track EPSS trends for CVE-2026-13635; the current EPSS probability is low but should be re-evaluated if public exploit tooling appears.

How to Mitigate CVE-2026-13635

Immediate Actions Required

Upgrade DSM to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 or later, matching the correct product branch.
Remove direct internet exposure of DSM management interfaces and place them behind a VPN or reverse proxy with authentication.
Audit DSM accounts and disable any that are unused, especially administrator accounts with default names.

Patch Information

Synology has released fixed DSM builds addressing CVE-2026-13635. Administrators should apply the update through Control Panel → Update & Restore, or download the appropriate DSM image directly from the Synology Download Center. Full remediation guidance is documented in the Synology Security Advisory SA-26-13.

Workarounds

Restrict inbound access to DSM Auth API endpoints at the network firewall to trusted management subnets only.
Enable DSM's built-in Auto Block and Account Protection to throttle repeated anonymous requests.
Require access to DSM through a corporate VPN or zero trust network access (ZTNA) gateway until patching is complete.

bash

# Configuration example: restrict DSM management ports to a trusted admin subnet
# Adjust interface and CIDR to your environment
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 5000 -j ACCEPT
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 5001 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP
iptables -A INPUT -p tcp --dport 5001 -j DROP