Home › Synology DSM › 7.2.2-72806 Update 9
Synology DSM 7.2.2-72806 Update 9 – safe to update?
0 problem reports and 0 positive reports found on Reddit (plus 2 other mentions). Out for 109 days and we haven't found any problem reports. Quiet isn't proof — but most bad releases get noticed within a week.
Newer release in this line: Synology DSM 7.2.2-72806 Update 10 (2026-10-12). If you're updating now, check that one instead — it may already fix the issues reported here.
Security update: this release fixes security issues (highest CVSS 9.8). Waiting carries its own risk — if your device is exposed, weigh that against the reports below.
Did you install 7.2.2-72806 Update 9?
Thanks — your vote is counted.
What's in this release
Fixed Issues • Fixed security vulnerabilities ( Synology-SA-26:06 ).
Source: Synology release notes
CVEs fixed
- CVE-2026-13639 CRITICAL 9.8 (NVD: fixed in this version)
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks. - CVE-2026-13684 CRITICAL 9.8 (NVD: fixed in this version)
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service att… - CVE-2026-13673 HIGH 8.8 (NVD: fixed in this version)
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and c… - CVE-2026-6205 HIGH 8.1 (NVD: fixed in this version)
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-servi… - CVE-2026-13635 MEDIUM 5.3 (NVD: fixed in this version)
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information. - CVE-2026-13623 MEDIUM 4.8 (NVD: fixed in this version)
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with a… - CVE-2026-13666 LOW 3.5 (NVD: fixed in this version)
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when… - CVE-2026-13683 LOW 2.7 (NVD: fixed in this version)
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated use…
Community reports
- Mention
Failed 7.3.2 upgrade DS918 · Reddit · 2026-10-14
I am attempting to upgrade my DS918+ from DSM 7.2.2 Update 9 to DSM 7.3.2-86009. I ran $ sudo synoupgrade --patch /volume1/downloads/dsm_updates/DSM_DS918+_86009.pat {"data":{"has_fail":false,"result":[{"api":"SYNO.Core.Upgrade.Patch","data": {"buildnumber":86009,"buildphase":"G…
- Mention
How do I run a command in a container? · Reddit · 2026-10-10
I have a DS916+ running DSM 7.2.2-72806 Update 9. I have the Container Manager version 24.0.2-1543 installed and running properly. I have one program installed in a container, running properly. The program is "FastChannels" version 5.1.0, and therein lies my problem. I'd like to…
Reports are found automatically and labelled by an AI model plus keyword rules — they can be wrong. Open the post to judge for yourself.
← Synology DSM 7.2.2-72806 Update 8 · Synology DSM 7.2.2-72806 Update 10 →
Other Synology DSM versions
- 7.4.1-90080 Update 1 2026-10-12
- 7.3.2-86009 Update 5 2026-10-12
- 7.2.2-72806 Update 10 2026-10-12
- 7.2.1-69057 Update 13 2026-10-12
- 7.4.1-90080 2026-07-23
- 7.3.2-86009 Update 4 2026-06-30
- 7.2.2-72806 Update 9 2026-06-30
- 7.2.1-69057 Update 12 2026-06-30
The weekly "safe to update?" email
One short email a week: what shipped, what broke, and what's safe to install. No spam.
Thanks — you're on the list.
We store only your email address and the date you signed up, to send this newsletter. We never sell or share it. Every email will have a one-click unsubscribe; you can also ask us to delete your address at any time. Privacy details.