Skip to main content

Synology DSM CVE-2026-40537

| EUVDEUVD-2026-82791 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-09-18 synology GHSA-7q9q-gp64-8j9m
SSRF Synology Diskstation Manager Dsm
4.3
CVSS 3.1 · Vendor: synology
Share

Severity by source

Vendor (synology) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
4.3 MEDIUM

Network-reachable API needing a low-privileged authenticated account (PR:L); SSRF returns only non-sensitive data (C:L), with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (synology).

CVSS VectorVendor: synology

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch available
Sep 18, 2026 - 09:16 EUVD
Analysis Generated
Sep 18, 2026 - 09:11 vuln.today

DescriptionCVE.org

A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.

AnalysisAI

Server-side request forgery in the PersonMail API of Synology DiskStation Manager (DSM) allows an authenticated low-privilege user to coerce the appliance into making arbitrary requests, potentially retrieving non-sensitive information from internal or external endpoints. The flaw affects DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated DSM user account (PR:L) with network access to the DiskStation's web/API interface; the vulnerable code path is the PersonMail API in Synology DSM on versions before 7.2.1-69057-10 (7.2.x), 7.2.2-72806-7 (7.2.2), and 7.3.2-86009-2 (7.3.x). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuinely low-priority issue by every available signal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Synology DSM to version 7.2.1-69057-10 (7.2.x branch), 7.2.2-72806-7 (7.2.2 branch), or 7.3.2-86009-2 (7.3.x branch) or later, as documented in Synology security advisory SA_26_06 (https://www.synology.com/en-global/security/advisory/Synology_SA_26_06). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Diskstation Manager Dsm

View all
CVE-2026-13639 CRITICAL
9.8 Sep 18

Synology DiskStation Manager (DSM) login logic uses insufficiently random values, letting remote unauthenticated attacke
CVE-2026-13684 CRITICAL
9.8 Sep 18

Improper output encoding in the SCGI service of Synology DiskStation Manager (DSM) lets unauthenticated remote attackers
CVE-2026-13673 HIGH
8.8 Sep 18

Authenticated remote attackers holding low-privileged credentials can exploit an incorrect permission assignment in the

CVE-2026-6205 HIGH
8.1 Sep 18

An external control of file name or path flaw in the Synology DiskStation Manager (DSM) Upload API allows remote authent
CVE-2026-40530 HIGH
8.0 Sep 18

CRLF injection in the Synology DiskStation Manager (DSM) User API lets a remote, low-privileged authenticated user (PR:L
CVE-2026-40539 HIGH
7.1 Sep 18

Man-in-the-middle attackers positioned on the network path between a Synology DiskStation and its configured mail server
CVE-2026-40535 MEDIUM
6.5 Sep 18

Unauthenticated path traversal in the Synology DiskStation Manager (DSM) Desktop API allows remote attackers to write a

CVE-2026-40532 MEDIUM
6.5 Sep 18

Information disclosure in Synology DiskStation Manager (DSM) allows remote authenticated users to obtain sensitive infor
CVE-2026-4036 MEDIUM
6.5 Sep 18

An authenticated SQL injection in the Sharing API of Synology DiskStation Manager (DSM) allows remote users with valid -
CVE-2026-40534 MEDIUM
5.4 Sep 18

Cross-site scripting in the Video API of Synology DiskStation Manager (DSM) allows a remote authenticated user to read o
CVE-2026-40533 MEDIUM
5.3 Sep 18

Unauthenticated remote attackers can query the Desktop API in Synology DiskStation Manager (DSM) to retrieve non-sensiti
CVE-2026-13635 MEDIUM
5.3 Sep 18

Improper encoding and escaping of output in the Auth API of Synology DiskStation Manager (DSM) lets remote, unauthentica

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

CVE-2026-40537 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy