Synology Products Vulnerability Allows Remote Code Execution
Summary
CERT-FR has issued an advisory regarding a critical vulnerability in Synology products that allows for remote code execution. The advisory details affected DSM and DSMUC versions and directs users to Synology's security bulletin for patches, noting that a fix for DSMUC is currently unavailable.
What changed
CERT-FR, the French national cybersecurity agency, has published an advisory (CERTFR-2026-AVI-0338) detailing a critical vulnerability (CVE-2026-32746) affecting specific versions of Synology's DiskStation Manager (DSM) and DSMUC software. This vulnerability enables remote code execution, posing a significant security risk to affected users.
Users of Synology products are strongly advised to consult Synology's security bulletin (SynologySA26_03) for instructions on applying available patches to their DSM systems. It is noted that a security patch for DSMUC 3.1 is currently unavailable, requiring users to exercise additional caution or seek alternative mitigation strategies. Failure to apply patches where available could lead to system compromise.
What to do next
- Consult Synology's security bulletin for available patches.
- Apply security patches to affected DSM versions.
- Monitor for updates regarding the DSMUC 3.1 patch.
Archived snapshot
Mar 23, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Premier Ministre S.G.D.S.N
Agence nationale
de la sécurité des
systèmes d'information
Paris, le 23 mars 2026 N° CERTFR-2026-AVI-0338 Affaire suivie par: CERT-FR
Avis du CERT-FR
Objet: Vulnérabilité dans les produits Synology
Gestion du document
| Référence | CERTFR-2026-AVI-0338 |
| Titre | Vulnérabilité dans les produits Synology |
| Date de la première version | 23 mars 2026 |
| Date de la dernière version | 23 mars 2026 |
| Source(s) | Bulletin de sécurité Synology SynologySA26_03 du 19 mars 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.
Risque
- Exécution de code arbitraire à distance
Systèmes affectés
- DSM versions 7.2.1.x antérieures à 7.2.1-69057-11
- DSM versions 7.2.2.x antérieures à 7.2.2-72806-8
- DSM versions 7.3.x antérieures à 7.3.2-86009-3
- DSMUC 3.1 toutes versions Le correctif de sécurité pour DSMUC 3.1 est indisponible pour l'instant.
Résumé
Une vulnérabilité a été découverte dans les produits Synology. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Documentation
- Bulletin de sécurité Synology SynologySA26_03 du 19 mars 2026
- https://www.synology.com/en-global/security/advisory/Synology_SA_26_03
- Référence CVE CVE-2026-32746
- https://www.cve.org/CVERecord?id=CVE-2026-32746
Gestion détaillée du document
- le 23 mars 2026 Version initiale
Named provisions
Related changes
Get daily alerts for CERT-FR Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-FR Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.