What is the CVSS score of EUVD-2026-82775?

EUVD-2026-82775 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-82775?

Yes, a patch is available for EUVD-2026-82775. Update the affected software to the latest version immediately.

Synology DSM EUVD-2026-82775

| CVE-2026-13635 MEDIUM

Improper Encoding or Escaping of Output (CWE-116)

2026-09-18 synology

GHSA-j6x3-5xfr-hc7h

Information Disclosure Synology Diskstation Manager Dsm

5.3

CVSS 3.1 · Vendor: synology

Severity by source

Vendor (synology) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable Auth API, no auth or interaction (PR:N/UI:N/AC:L); impact limited to disclosure of non-sensitive data (C:L, I:N/A:N), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (synology).

CVSS VectorVendor: synology

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Sep 18, 2026 - 09:16 EUVD

Analysis Generated

Sep 18, 2026 - 09:14 vuln.today

DescriptionCVE.org

An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.

AnalysisAI

Improper encoding and escaping of output in the Auth API of Synology DiskStation Manager (DSM) lets remote, unauthenticated attackers retrieve information the vendor classifies as non-sensitive, affecting deployments before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) confirms exploitation needs no credentials, no user interaction, and no non-default configuration, so the only meaningful barrier is impact rather than access. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation is possible against default configurations of Synology DiskStation Manager (DSM) with a network-reachable Auth API on versions before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Low-priority despite the medium 5.3 CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade DSM to 7.2.1-69057-12 or later, 7.2.2-72806-9 or later, 7.3.2-86009-4 or later, or 7.4-90075 or later, as documented in Synology advisory SA_26_13 (https://www.synology.com/en-global/security/advisory/Synology_SA_26_13); DSM updates can be applied through Control Panel > Update & Restore, and appliances that cannot be immediately updated should at minimum be moved onto the nearest fixed build within their existing release train. … Detailed patch versions, workarounds, and compensating controls in full report.