Changeflow GovPing Data Privacy & Cybersecurity Synology Products Vulnerability Allows Remote C...
Priority review Notice Added Final

Synology Products Vulnerability Allows Remote Code Execution

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published March 23rd, 2026
Detected March 23rd, 2026
Email

Summary

CERT-FR has issued an advisory regarding a critical vulnerability in Synology products that allows for remote code execution. The advisory details affected DSM and DSMUC versions and directs users to Synology's security bulletin for patches, noting that a fix for DSMUC is currently unavailable.

View original document View source feed page

What changed

CERT-FR, the French national cybersecurity agency, has published an advisory (CERTFR-2026-AVI-0338) detailing a critical vulnerability (CVE-2026-32746) affecting specific versions of Synology's DiskStation Manager (DSM) and DSMUC software. This vulnerability enables remote code execution, posing a significant security risk to affected users.

Users of Synology products are strongly advised to consult Synology's security bulletin (SynologySA26_03) for instructions on applying available patches to their DSM systems. It is noted that a security patch for DSMUC 3.1 is currently unavailable, requiring users to exercise additional caution or seek alternative mitigation strategies. Failure to apply patches where available could lead to system compromise.

What to do next

  1. Consult Synology's security bulletin for available patches.
  2. Apply security patches to affected DSM versions.
  3. Monitor for updates regarding the DSMUC 3.1 patch.

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 23 mars 2026 N° CERTFR-2026-AVI-0338 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Vulnérabilité dans les produits Synology

Gestion du document

| Référence | CERTFR-2026-AVI-0338 |
| Titre | Vulnérabilité dans les produits Synology |
| Date de la première version | 23 mars 2026 |
| Date de la dernière version | 23 mars 2026 |
| Source(s) | Bulletin de sécurité Synology SynologySA26_03 du 19 mars 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risque

  • Exécution de code arbitraire à distance

Systèmes affectés

  • DSM versions 7.2.1.x antérieures à 7.2.1-69057-11
  • DSM versions 7.2.2.x antérieures à 7.2.2-72806-8
  • DSM versions 7.3.x antérieures à 7.3.2-86009-3
  • DSMUC 3.1 toutes versions Le correctif de sécurité pour DSMUC 3.1 est indisponible pour l'instant.

Résumé

Une vulnérabilité a été découverte dans les produits Synology. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 23 mars 2026 Version initiale

Named provisions

Risk Affected Systems Summary Solutions Documentation

Related changes

Favicon for www.cert.ssi.gouv.fr Qnap Products Security Vulnerabilities
Priority review Mar 23, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Citrix Products Vulnerabilities
Urgent Mar 23, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr CPython Vulnerability Allows Security Policy Bypass
Priority review Mar 23, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Uptime Kuma Vulnerability Allows Information Disclosure
Priority review Mar 23, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de MinIO Vulnerability Allows Info Disclosure and Security Bypass
Urgent Mar 23, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de PyTorch Vulnerability Allows Local Code Execution
Priority review Mar 23, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity
Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
CERT-FR
Published
March 23rd, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0338

Who this affects

Applies to
Technology companies
Industry sector
5112 Software & Technology
Activity scope
Vulnerability Management System Patching
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Product Security Vulnerability Management

Browse Categories

Agriculture & Food Safety 61 Banking & Finance 230 Consumer Protection 40 Courts & Legal 315 Data Privacy & Cybersecurity 63 Defense & National Security 48 Education 20 Energy 104 Environment 83 Government & Legislation 259 Healthcare 131 Housing 15 Immigration 9 Insurance 56 Labor & Employment 111 Legal & Courts 1 Pharma & Drug Safety 97 Securities & Markets 78 Tax 63 Telecom & Technology 47 Trade & Sanctions 124 Transportation 56

Get Data Privacy & Cybersecurity alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.