Home › Synology DSM › 7.4-90075
Synology DSM 7.4-90075 – safe to update?
0 problem reports and 1 positive report found on Reddit (plus 2 other mentions). Out for 123 days with positive reports and no problem reports.
⚠ Read before updating
The official notes for this release include changes that may not be reversible or that remove things you might rely on:
- PHP 8.1, Mail Station, and Synology Mail Server are no longer supported.
Security update: this release fixes security issues (highest CVSS 9.8). Waiting carries its own risk — if your device is exposed, weigh that against the reports below.
Did you install 7.4-90075?
Thanks — your vote is counted.
What's in this release
Compatibility & Installation • To ensure compatibility, the following packages will be automatically updated or will require a manual update to a compatible version: Synology Chat Server, HighAvailability(SHA), Synology MailPlus Server, PACS, QuickConnect, ReplicationService, SecureSignIn, SnapshotReplication, WebStat…
Source: Synology release notes
CVEs fixed
- CVE-2026-13639 CRITICAL 9.8 (NVD: fixed in this version)
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks. - CVE-2026-13684 CRITICAL 9.8 (NVD: fixed in this version)
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service att… - CVE-2023-43115 HIGH 8.8 (named in release notes)
In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a docume… - CVE-2026-13673 HIGH 8.8 (NVD: fixed in this version)
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and c… - CVE-2026-6205 HIGH 8.1 (NVD: fixed in this version)
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-servi… - CVE-2026-13635 MEDIUM 5.3 (NVD: fixed in this version)
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information. - CVE-2026-13623 MEDIUM 4.8 (NVD: fixed in this version)
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with a… - CVE-2026-13666 LOW 3.5 (NVD: fixed in this version)
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when… - CVE-2026-13683 LOW 2.7 (NVD: fixed in this version)
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated use…
Community reports
- Fine
How remove PHP 7.4 when HyperBackup is in use? · Reddit · 2026-09-07
I am looking at updating from DSM 7.2 to 7.4 When I do this, I get a prompt that PHP 7.4 will be removed. I am OK with that... but hyper backup (which I use to back up the NAS to C2) is dependendent on PHP 7.4 How do I move forward? SOLUTION Go ahead with the upgrade to DSM 7.4.…
- Mention
Update 218+ DSM · Reddit · 2026-10-13
Hello, I have a Synology DS 218+ that is currently running DSM 7.1.1-42962 Update 9. Everything is running fine. I am not seeing a pending update in the DSM update settings, it says I am up to date. Should I manually update to DSM 7.4 or later? Thank You
- Mention
DSM can't use host-managed SMR drives, so I pass the DX1222's SATA controller to a VMM guest: 3 × HC680 27 TB on a DS3622xs+, what works and what it costs · Reddit · 2026-10-11
I've had three WD Ultrastar DC HC680 27 TB host-managed SMR drives running with my DS3622xs+ since mid-September (the current pool layout since 2026-09-26). DSM can't use them: every Synology kernel is built without zoned block support ( CONFIG_BLK_DEV_ZONED ), so behind the DX1…
Reports are found automatically and labelled by an AI model plus keyword rules — they can be wrong. Open the post to judge for yourself.
← Synology DSM 7.3.2-86009 Update 5 · Synology DSM 7.4.1-90080 →
Other Synology DSM versions
- 7.4.1-90080 Update 1 2026-10-12
- 7.3.2-86009 Update 5 2026-10-12
- 7.2.2-72806 Update 10 2026-10-12
- 7.2.1-69057 Update 13 2026-10-12
- 7.4.1-90080 2026-07-23
- 7.3.2-86009 Update 4 2026-06-30
- 7.2.2-72806 Update 9 2026-06-30
- 7.2.1-69057 Update 12 2026-06-30
The weekly "safe to update?" email
One short email a week: what shipped, what broke, and what's safe to install. No spam.
Thanks — you're on the list.
We store only your email address and the date you signed up, to send this newsletter. We never sell or share it. Every email will have a one-click unsubscribe; you can also ask us to delete your address at any time. Privacy details.