Synology says ransomware is exploiting a patched DSM flaw on outdated NAS devices

TLDR

• Synology says attackers are exploiting a vulnerability patched in December 2024 to encrypt data on outdated DSM versions.¹
• It names no CVE but points to Synology-SA-24:20, which covers CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445.¹²
• Chinese firm 360 attributes the samples it examined to different September 2026 flaws; the sources do not reconcile the accounts.⁴⁵

Synology said in a notice dated 29 October 2026 that it has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DiskStation Manager (DSM), with attacks that aim to encrypt data and extort ransom.¹ It urges users running vulnerable versions to update DSM immediately, recommends enabling automatic updates, and refers readers to Synology-SA-24:20.¹ BleepingComputer reported the warning on 2 November, describing it as a Thursday advisory, and says Synology rarely issues such alerts, the last being in August 2019 after brute-force attacks that led to eCh0raix ransomware infections.³ NAS Compares says Synology's public warning does not name the ransomware family or give a victim count.⁴

Synology's notice names no CVE, and BleepingComputer says Synology has yet to share which vulnerability is being exploited.¹³ Synology-SA-24:20, titled "DSM (PWN2OWN 2024)", was published on 5 November 2024 and lists CVE-2024-10441 (CVSS 9.8, remote code execution), CVE-2024-50629 (CVSS 5.3, reading limited files) and CVE-2024-10445 (CVSS 4.3, writing limited files).² BleepingComputer calls the linked advisory a November 2024 advisory while quoting Synology's reference to a December 2024 patch.³ The advisory's revision history shows the initial release on 5 November 2024, DSM 7.2.1 and DSM 7.1 updates on 12 and 26 November, and DSM 6.2 added with its own update on 5 December 2024.² Synology's notice does not say which release it means by December 2024.¹ The advisory lists fixed builds of DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8 or above, and BleepingComputer advises blocking internet access to the management web interface as well as updating.²³

BleepingComputer reports a wave of Synology customers whose data was encrypted, with the first reports surfacing more than two weeks before its article, files given a .L0CK3D extension and a ransom note named read-me3.txt.³ It says victims were prompted to buy a "C3rb3r Decryptor" tool from a dark web portal for thousands of dollars, and quotes the note as saying: "The only way to decrypt your files safely is to buy the special decryption software 'C3rb3r Decryptor'," and as offering to restore one file for free.³ On scale, BleepingComputer says Shadowserver tracks over 380,000 internet-exposed Synology NAS devices but gives no information on how many are already patched or are honeypots.³ Cyber Security News says the available reporting does not establish how many devices have been compromised.⁵

The accounts of the entry point differ. NAS Compares reports that Qihoo 360 received requests for help from early October, identified the ransomware as C3RB3R, a variant of the Cerber family, and says the samples it examined used CVE-2026-13639 and CVE-2026-13684, which Synology fixed on 18 September 2026.⁴ Synology-SA-26:13 rates both flaws Critical at CVSS 9.8, with fixes in DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12.⁶ Cyber Security News reports that Solar Emergency Response Team examined an affected device running DSM 7.4.1-90080 Update 1 and had not ruled out an unknown vulnerability, and that the published accounts neither explain the mismatch nor confirm a zero-day.⁵ NAS Compares likewise says the public statements do not explain whether they describe different attacks, entry points or overlapping activity.⁴

Why it matters: the sources do not settle which flaw is being used, so owners of outdated DSM units are left with the common advice to update, enable automatic updates and keep the management interface off the internet.¹³⁴