On October 29, 2026, Taiwanese company Synology confirmed that attackers are exploiting a vulnerability that was already fixed back in December 2024 to attack NAS devices running outdated versions of DiskStation Manager (DSM). The aim of the attacks is to encrypt data and extort victims. All Synology NAS owners who have not updated DSM in the last two years must immediately install the latest patches: the vulnerability is being actively exploited in real-world attacks.
Three vulnerabilities in the advisory — but which one is being exploited?
Synology refers to security advisory Synology-SA-24:20, which lists three DSM vulnerabilities. However, the company has not specified which one is being used in the current attacks. This is a significant detail: the three CVEs have different severity levels and affect different DSM branches.
- CVE-2024-10441 (CVSS 9.8) — an improper output encoding/escaping vulnerability in the DSM system plugin daemon. Allows unauthenticated remote code execution (RCE). Affects DSM 7.2, 7.2.1, and 7.2.2.
- CVE-2024-50629 (CVSS 5.3) — a similar vulnerability in the webapi component that allows a remote attacker to read a limited set of files. Affects DSM 7.1, 7.2, 7.2.1, and 7.2.2.
- CVE-2024-10445 (CVSS 4.3) — an improper certificate validation vulnerability in the DSM update mechanism that allows writing a limited set of files. Affects all branches from DSM 6.2 through 7.2.2. Notably, the CVSS vector for this vulnerability indicates access from an adjacent network rather than from the internet.
Given that the attacks are aimed at encrypting data, the most likely candidate appears to be CVE-2024-10441 with a score of 9.8 and a remote code execution capability. However, this is an assumption: Synology has not confirmed the specific vector, and a chain of multiple vulnerabilities cannot be ruled out.
The boundaries of vulnerable versions differ
An important nuance that is easy to overlook: the three CVEs have different ranges of affected DSM versions. CVE-2024-10441 applies only to the DSM 7.2.x branches, whereas CVE-2024-10445 covers all supported branches down to DSM 6.2. This means administrators cannot rely on a single patch table for all three vulnerabilities — they must check the exact DSM version and apply the corresponding update:
- DSM 7.2.2 → update to 7.2.2-72806-1 or later
- DSM 7.2.1 → update to 7.2.1-69057-6 or later
- DSM 7.2 → update to 7.2-64570-4 or later
- DSM 7.1 → update to 7.1.1-42962-7 or later
- DSM 6.2 → update to 6.2.4-25556-8 or later
Historical context: NAS as a ransomware target
NAS devices have long attracted ransomware operators: they store critical data, are often accessible from the internet, and are frequently updated with delays. In 2021, Synology warned about a wave of brute-force password attacks linked to the StealthWorker malware family. At that time, the company emphasized that no exploitation of software vulnerabilities had been detected — the attacks relied solely on guessing weak credentials.
At the same time, researchers from Unit 42 (Palo Alto Networks) observed activity of the eCh0raix ransomware targeting QNAP and Synology devices. In the case of QNAP, the attackers leveraged the CVE-2021-28799 vulnerability (NVD) in the HBS 3 component, which was later added to the CISA Known Exploited Vulnerabilities catalog.
The current 2026 campaign is fundamentally different from both historical episodes: according to Synology, the attackers are exploiting a software vulnerability rather than weak passwords. Based on the data available, no link has been established to eCh0raix or StealthWorker.
What remains unknown
The available primary sources do not disclose a number of critical details about the current campaign. Unknown factors include: the scale of the attacks (number of affected devices and organizations), attribution of the threat actor, specific indicators of compromise (IOC), and the ransom amount demanded. User posts on forums mention ransomware adding the “.L0CK3D” extension, but this information comes from unverified sources and has not been confirmed by independent researchers.
Security recommendations
To protect against the current wave of attacks and reduce the overall attack surface for Synology NAS devices:
- Immediately update DSM to the versions specified in advisory Synology-SA-24:20. Prioritize devices that are accessible from the internet.
- Enable automatic DSM updates — Synology explicitly recommends this measure to prevent similar situations in the future.
- Review NAS network exposure: if the device does not need to be accessible from the internet, disable external access or restrict it via VPN.
- Strengthen authentication: enable multi-factor authentication and automatic blocking after failed login attempts. This will protect against brute-force attacks, which remain a relevant threat alongside vulnerability exploitation.
- Check your backups: make sure critical data has an offline copy or a copy that is not accessible from the NAS device itself. Ransomware that gains access to a NAS can also encrypt attached backup storage.
Patches for all affected DSM branches have been available since December 2024 — almost two years. Devices left unpatched for such a long time are vulnerable not only to the current campaign but also to any other vulnerabilities fixed during this period. Synology NAS administrators should treat DSM updates not as a one-off response to a specific threat, but as a mandatory element of regular maintenance — and apply the latest patches today.
