OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-13673

HIGH · CVSS 8.8 EPSS 0.39%

Source: NVD + CISA KEV + EPSS · Published 2026-09-18 · Last synced 2026-10-12

CyberRota Analysis

AI-Generated

A critical vulnerability in the LDAP API of Synology DiskStation Manager allows remote authenticated users to improperly access and manipulate files, potentially leading to data exposure and denial-of-service attacks. Organizations using affected versions of DSM should prioritize patching to mitigate the risk of unauthorized access and service disruption. Immediate action is essential for those managing sensitive data or critical infrastructure.

CVE
CVE-2026-13673
Severity
HIGH
CVSS
8.8
EPSS
0.39%

Original NVD Description

An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.