CVE-2026-40533: Synology DSM Information Disclosure Flaw

CVE-2026-40533 Overview

CVE-2026-40533 is an information exposure vulnerability in the Desktop API component of Synology DiskStation Manager (DSM). The flaw allows unauthenticated remote attackers to obtain non-sensitive information from affected devices through crafted data queries. The vulnerability is classified under [CWE-202]: Exposure of Sensitive Information Through Data Queries. Synology addressed the issue in DSM versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2.

Critical Impact
Remote attackers can retrieve non-sensitive information from the DSM Desktop API without authentication, which may aid reconnaissance for subsequent attacks against network-attached storage deployments.

Affected Products

Synology DiskStation Manager (DSM) versions before 7.2.1-69057-10
Synology DiskStation Manager (DSM) versions before 7.2.2-72806-7
Synology DiskStation Manager (DSM) versions before 7.3.2-86009-2

Discovery Timeline

2026-09-18 - CVE-2026-40533 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-40533

Vulnerability Analysis

The vulnerability resides in the Desktop API of Synology DSM, the web-based operating system that manages Synology network-attached storage (NAS) devices. The Desktop API handles requests from the DSM web interface for user session data, application state, and system information. Improper access controls on certain query endpoints allow remote attackers to receive information intended to be restricted.

Exploitation requires no authentication, no user interaction, and only network access to the DSM management interface. The disclosed data is characterized by Synology and the CVSS assessment as non-sensitive, limiting the direct impact of a single successful request. However, attackers frequently chain low-impact disclosure flaws with other weaknesses to build a targeted attack profile.

Root Cause

The root cause is improper filtering of information returned through Desktop API data queries [CWE-202]. The API responds to queries with data fields that should not be exposed to unauthenticated callers, enabling passive information gathering against exposed DSM instances.

Attack Vector

An attacker sends crafted HTTP requests to the Desktop API endpoints on a network-reachable DSM instance. Because no credentials are required, any actor able to reach the management interface — including those scanning the internet for exposed NAS devices — can retrieve the disclosed information. No specific exploitation code has been published, and no proof-of-concept is listed in public exploit databases. See the Synology Security Advisory SA-26-06 for vendor-provided technical details.

Detection Methods for CVE-2026-40533

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to Desktop API endpoints under the DSM web management interface, particularly from external or unexpected source addresses.
Bursts of API queries from a single IP enumerating multiple Desktop API methods within a short time window.
Access to DSM management ports (default 5000/tcp and 5001/tcp) from geographies or networks that do not match legitimate administrator locations.

Detection Strategies

Review DSM web server access logs for repeated requests to Desktop API URIs from unauthenticated sessions.
Correlate management-interface traffic against your list of authorized administrator IP ranges and flag deviations.
Compare installed DSM build numbers against the fixed versions (7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2) to identify unpatched appliances.

Monitoring Recommendations

Forward DSM system and web access logs to a centralized logging platform for retention and query.
Alert on any external network flow reaching DSM management ports if the appliance is intended to be internal-only.
Baseline normal Desktop API request volume per source IP and generate alerts on statistically significant spikes.

How to Mitigate CVE-2026-40533

Immediate Actions Required

Upgrade affected DSM instances to 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2, or later as applicable to your release train.
Restrict access to the DSM web management interface to trusted administrative networks using firewall rules or VPN gating.
Audit which DSM appliances are exposed to the public internet using external attack surface tools and remove unnecessary exposure.

Patch Information

Synology has released fixed builds for each affected DSM release train. Administrators should install DSM 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 via the Control Panel update mechanism or by downloading the appropriate .pat file from the Synology Download Center. Refer to the Synology Security Advisory SA-26-06 for the authoritative fix matrix.

Workarounds

Place the DSM management interface behind a reverse proxy or VPN that enforces authentication before requests reach the Desktop API.
Disable direct internet exposure of DSM ports 5000/tcp and 5001/tcp where remote administration is not required.
Enforce Synology QuickConnect access policies and IP allow lists to limit which clients can reach the management interface.

bash

# Example: restrict DSM management ports to an internal admin subnet using Synology's built-in firewall syntax
# Allow only 10.10.0.0/24 to reach DSM web UI on ports 5000 and 5001
# (configure via Control Panel > Security > Firewall)
source_ip=10.10.0.0/24
ports=5000,5001
action=allow
default_action=deny