Synology NAS users are reporting widespread ransomware attacks where devices are being encrypted, rendering data inaccessible. The company's security team confirmed that attackers are exploiting vulnerabilities that were previously patched in 2024 and 2026.
The most critical vulnerability identified is CVE-2024-10441, a remote code execution flaw with a severity score of 9.8. Additionally, the 360 anti-ransomware team noted attacks utilizing CVE-2026-13639 and CVE-2026-13684, which were addressed in the Synology-SA-26:13 security bulletin released on September 18, 2026.
Synology advises users to update their DSM systems immediately to the latest versions to mitigate these risks. There is currently no evidence of zero-day vulnerabilities affecting the DSM platform. Users are also urged to implement strong passwords and multi-factor authentication.
To further secure devices, the company recommends disabling public internet exposure, including QC and DDNS services, and closing SSH port 22. For remote access, users should consider encrypted networking tools like WireGuard. Enabling automatic updates is also highly recommended.
Given the ongoing threat to NAS devices across all brands, Synology emphasizes the importance of data redundancy. Users are advised to maintain off-site backups, such as cloud storage, and utilize tools like Cloud Sync to ensure critical files are protected against ransomware.
