Home › Synology DSM › 7.2.2-72806 Update 7
Synology DSM 7.2.2-72806 Update 7 – safe to update?
0 problem reports and 0 positive reports found on Reddit. Out for 215 days and we haven't found any problem reports. Quiet isn't proof — but most bad releases get noticed within a week.
Newer release in this line: Synology DSM 7.2.2-72806 Update 10 (2026-10-12). If you're updating now, check that one instead — it may already fix the issues reported here.
Security update: this release fixes security issues (highest CVSS 8). Waiting carries its own risk — if your device is exposed, weigh that against the reports below.
Did you install 7.2.2-72806 Update 7?
Thanks — your vote is counted.
What's in this release
Fixed Issues • Fixed multiple security vulnerabilities.
Source: Synology release notes
CVEs fixed
- CVE-2026-40530 HIGH 8 (NVD: fixed in this version)
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and condu… - CVE-2026-40539 HIGH 7.1 (NVD: fixed in this version)
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attack… - CVE-2026-4036 MEDIUM 6.5 (NVD: fixed in this version)
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbit… - CVE-2026-40532 MEDIUM 6.5 (NVD: fixed in this version)
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information. - CVE-2026-40535 MEDIUM 6.5 (NVD: fixed in this version)
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and cond… - CVE-2026-40534 MEDIUM 5.4 (NVD: fixed in this version)
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write… - CVE-2026-40533 MEDIUM 5.3 (NVD: fixed in this version)
An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information. - CVE-2026-40531 MEDIUM 4.3 (NVD: fixed in this version)
An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks. - CVE-2026-40536 MEDIUM 4.3 (NVD: fixed in this version)
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive… - CVE-2026-40537 MEDIUM 4.3 (NVD: fixed in this version)
A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information. - CVE-2026-40538 LOW 3.7 (NVD: fixed in this version)
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks.
Community reports
- No community reports found yet. We check Reddit every few hours for posts that mention this version.
Reports are found automatically and labelled by an AI model plus keyword rules — they can be wrong. Open the post to judge for yourself.
← Synology DSM 7.2.2-72806 Update 6 · Synology DSM 7.2.2-72806 Update 8 →
Other Synology DSM versions
- 7.4.1-90080 Update 1 2026-10-12
- 7.3.2-86009 Update 5 2026-10-12
- 7.2.2-72806 Update 10 2026-10-12
- 7.2.1-69057 Update 13 2026-10-12
- 7.4.1-90080 2026-07-23
- 7.3.2-86009 Update 4 2026-06-30
- 7.2.2-72806 Update 9 2026-06-30
- 7.2.1-69057 Update 12 2026-06-30
The weekly "safe to update?" email
One short email a week: what shipped, what broke, and what's safe to install. No spam.
Thanks — you're on the list.
We store only your email address and the date you signed up, to send this newsletter. We never sell or share it. Every email will have a one-click unsubscribe; you can also ask us to delete your address at any time. Privacy details.