Home › Synology DSM
Synology DSM: which version is safe to update to?
DiskStation Manager, the operating system on Synology NAS devices. Every release below is checked against official notes, NVD CVE data and public community reports.
All recent releases
7.4.1-90080 Update 1
Probably fine — wait a few days
7.3.2-86009 Update 5
Probably fine — wait a few days
7.2.2-72806 Update 10
Probably fine — wait a few days
7.2.1-69057 Update 13
Probably fine — wait a few days
7.4.1-90080
No widespread problems
7.3.2-86009 Update 4 8 CVEs
No problems reported
7.2.2-72806 Update 9 8 CVEs
No problems reported
7.2.1-69057 Update 12 8 CVEs
No problems reported
7.4-90075 breaking changes 9 CVEs
Safe to update
7.3.2-86009 Update 3 1 CVE
No widespread problems
7.2.2-72806 Update 8 1 CVE
No problems reported
7.2.1-69057 Update 11 1 CVE
No problems reported
7.3.2-86009 Update 2 11 CVEs
No widespread problems
7.2.2-72806 Update 7 11 CVEs
No problems reported
7.2.1-69057 Update 10 11 CVEs
No problems reported
7.3.2-86009 Update 1 1 CVE
No widespread problems
7.2.2-72806 Update 6 1 CVE
No problems reported
7.2.1-69057 Update 9 1 CVE
No problems reported
Recent CVEs (last 120 days)
- CVE-2026-13639 CRITICAL 9.8 An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and c…
- CVE-2026-13684 CRITICAL 9.8 An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary…
- CVE-2026-13673 HIGH 8.8 An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated user…
- CVE-2026-6205 HIGH 8.1 An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arb…
- CVE-2026-40530 HIGH 8 An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to…
- CVE-2026-40539 HIGH 7.1 An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary fi…
- CVE-2026-40532 MEDIUM 6.5 A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive inf…
- CVE-2026-40535 MEDIUM 6.5 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote a…
The weekly "safe to update?" email
One short email a week: what shipped, what broke, and what's safe to install. No spam.
Thanks — you're on the list.
We store only your email address and the date you signed up, to send this newsletter. We never sell or share it. Every email will have a one-click unsubscribe; you can also ask us to delete your address at any time. Privacy details.