Synology Mail Station Vulnerability Advisory

CERT-FR Security Advisories

Published April 3rd, 2026

Detected April 3rd, 2026

Summary

CERT-FR issued a security advisory warning of a vulnerability in Synology Mail Station (versions prior to 30000001.3.19-20332 for DSM). The vulnerability, tracked as CVE-2026-5129, allows attackers to compromise data confidentiality and integrity. Users are advised to apply the vendor patch referenced in Synology security advisory Synology_SA_26_04.

View original document View source feed page

What changed

CERT-FR published advisory CERTFR-2026-AVI-0393 disclosing a vulnerability in Synology Mail Station affecting versions before 30000001.3.19-20332 for DSM. The vulnerability (CVE-2026-5129) allows attackers to cause data confidentiality breaches and data integrity violations. The source is Synology security advisory SynologySA26_04 dated March 31, 2026.

Organizations running affected Synology Mail Station versions should immediately verify their current software version, download the security patch from Synology's advisory page, and apply it without delay. Failure to patch could expose email communications and stored data to unauthorized access or tampering. No compliance deadline or penalty structure is specified, but immediate action is warranted given the confidentiality and integrity risks.

What to do next

Identify all Synology Mail Station installations and verify current version against affected versions (prior to 30000001.3.19-20332 for DSM)
Download and apply the security patch from Synology advisory Synology_SA_26_04
Monitor CVE-2026-5129 for any updated severity ratings or additional mitigation guidance

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 03 avril 2026 N° CERTFR-2026-AVI-0393 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Vulnérabilité dans Synology Mail Station

Gestion du document

Risques

Atteinte à l'intégrité des données
Atteinte à la confidentialité des données

Systèmes affectés

Mail Station versions antérieures à 30000001.3.19-20332 pour DSM

Résumé

Une vulnérabilité a été découverte dans Synology Mail Station. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.