Home › Synology DSM › 7.3.2-86009 Update 2

Synology DSM 7.3.2-86009 Update 2 – safe to update?

Newer release in this line: Synology DSM 7.3.2-86009 Update 5 (2026-10-12). If you're updating now, check that one instead — it may already fix the issues reported here.

Security update: this release fixes security issues (highest CVSS 8). Waiting carries its own risk — if your device is exposed, weigh that against the reports below.

What's in this release

CVEs fixed

• CVE-2026-40530 HIGH 8 (NVD: fixed in this version)
  An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and condu…
• CVE-2026-40539 HIGH 7.1 (NVD: fixed in this version)
  An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attack…
• CVE-2026-4036 MEDIUM 6.5 (NVD: fixed in this version)
  An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbit…
• CVE-2026-40532 MEDIUM 6.5 (NVD: fixed in this version)
  A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information.
• CVE-2026-40535 MEDIUM 6.5 (NVD: fixed in this version)
  An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and cond…
• CVE-2026-40534 MEDIUM 5.4 (NVD: fixed in this version)
  An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write…
• CVE-2026-40533 MEDIUM 5.3 (NVD: fixed in this version)
  An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information.
• CVE-2026-40531 MEDIUM 4.3 (NVD: fixed in this version)
  An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks.
• CVE-2026-40536 MEDIUM 4.3 (NVD: fixed in this version)
  An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive…
• CVE-2026-40537 MEDIUM 4.3 (NVD: fixed in this version)
  A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
• CVE-2026-40538 LOW 3.7 (NVD: fixed in this version)
  An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks.

Community reports

• Problem DSM 7.3.2-86009 Update 2 and DSM 7.3.2-86009 Update 3 - NIC TX write regression · Reddit · 2026-03-22

  Self explanatory. The moment these two were installed my SMB writes to the NAS (from clients) tanked. Example when not working correctly (2.5gbps to 2.5gbps test): PS D:\Benchmarks\iPerf 3> .\iperf3.exe -c 192.168.10.100 Connecting to host 192.168.10.100, port 5201 [ 5] local 19…

• Problem Failure to Connect after DSM 7.3.2-86009 Update 2 · Reddit · 2026-03-18

  Today I applied DSM 7.3.2-86009 Update 2 on my DS423+. Upon reboot, neither of my BeeLink PCs running Win11 Pro 25H2 can connect to it via File Explorer. It seems fine using my laptop Win11 Pro 25H2. I tried drive mapping and UNC and I get challenged for credentials which fail -…

• Fine DS220+ update to DSM 7.3.2-86009 Update 2 · Reddit · 2026-03-19

  Hi, all. I got the notice that DSM 7.3.2-86009 Update 2 is available for my DS220+. In the Update & Restore panel, there is an option to download the update. I have done so (twice), and received confirmation via email, twice, that the package had dled and was ready for install.…

• Mention DSM 7.3.2-86009 Update 3 · Reddit · 2026-03-19

  Release 3 days after update 2 ... https://www.synology.com/fr-fr/releaseNote/DSM?model=DS918%2B#ver_86009-3 For Telnetd again...

• Mention DSM Update Version: 7.3.2-86009 Update 2 · Reddit · 2026-03-16

  (2026-03-16) Important notes Your Synology NAS may not notify you of this DSM update because of the following reasons. If you want to update your DSM to this version now, please click here to update it manually. The update is not available in your region yet. The update is expec…

Reports are found automatically and labelled by an AI model plus keyword rules — they can be wrong. Open the post to judge for yourself.

← Synology DSM 7.3.2-86009 Update 1 · Synology DSM 7.3.2-86009 Update 3 →

Other Synology DSM versions

• 7.4.1-90080 Update 1 2026-10-12
• 7.3.2-86009 Update 5 2026-10-12
• 7.2.2-72806 Update 10 2026-10-12
• 7.2.1-69057 Update 13 2026-10-12
• 7.4.1-90080 2026-07-23
• 7.3.2-86009 Update 4 2026-06-30
• 7.2.2-72806 Update 9 2026-06-30
• 7.2.1-69057 Update 12 2026-06-30