Improper Certificate Validation in Synology DiskStation Manager
CVE-2026-40539

7.1HIGH

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
18 September 2026

What is CVE-2026-40539?

An improper certificate validation vulnerability in the Email API of Synology DiskStation Manager allows potential attackers to intercept communications through man-in-the-middle tactics. This vulnerability can enable attackers to gain unauthorized access to sensitive files and may lead to denial-of-service conditions. It affects multiple versions of DSM, highlighting the importance of maintaining updated software to mitigate such risks. Users are encouraged to apply the necessary patches to enhance their system's security.

Affected Version(s)

DiskStation Manager (DSM) 7.3

DiskStation Manager (DSM) 7.3 < 7.3.2-86009-2

DiskStation Manager (DSM) 7.2.2 < 7.2.2-72806-7

References

https://www.synology.com/en-global/security/advisory/Syno...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ben R of Interrupt Labs (https://www.interruptlabs.co.uk)
.