What is the CVSS score of CVE-2026-40536?

CVE-2026-40536 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-40536?

Yes, a patch is available for CVE-2026-40536. Update the affected software to the latest version immediately.

Synology DiskStation Manager CVE-2026-40536

EUVD-2026-82790 MEDIUM

Path Traversal (CWE-22)

2026-09-18 synology

GHSA-p44h-mfjw-mpmg

Path Traversal Synology Diskstation Manager Dsm

4.3

CVSS 3.1 · Vendor: synology

Severity by source

Vendor (synology) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Remote-reachable API needing a valid DSM account (PR:L), no interaction; path traversal yields only non-sensitive read (C:L), no write or DoS (I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (synology).

CVSS VectorVendor: synology

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Sep 18, 2026 - 09:16 EUVD

Analysis Generated

Sep 18, 2026 - 09:11 vuln.today

DescriptionCVE.org

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.

AnalysisAI

Path traversal in the Audio API of Synology DiskStation Manager (DSM) allows remote authenticated users to read files outside the intended directory, though the vendor explicitly scopes the exposed content as non-sensitive information. Affected are DSM installations before 7.2.1-69057-10, before 7.2.2-72806-7, and before 7.3.2-86009-2; the flaw is network-reachable (AV:N) but requires a valid DSM account (PR:L) and needs no user interaction, and it carries no write or availability impact (CVSS 3.1 base 4.3). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated DSM account (PR:L) with network access to the DiskStation Manager Audio API; no user interaction is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a low-priority vulnerability despite being remotely reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade DSM to 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 (matching your current branch), as documented in Synology Security Advisory Synology_SA_26_06 at https://www.synology.com/en-global/security/advisory/Synology_SA_26_06; DSM updates are applied through Control Panel > Update & Restore, and the NAS may need a reboot or service restart for the Audio API component to reload. … Detailed patch versions, workarounds, and compensating controls in full report.