Vulnerability in Synology Diskstation Manager (Dsm)
CVE-2026-40539
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks.
Vulnerability class: Improper Certificate Validation
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- security@synology.com (vendor-advisory)
Frequently asked questions
- What is CVE-2026-40539?
- CVE-2026-40539 is a high-severity vulnerability in Synology Diskstation Manager (Dsm), classified under Improper Certificate Validation. CVSS score: 7.1/10. Published 2026-09-18.
- How severe is CVE-2026-40539?
- High severity. CVSS v3 base score is 7.1 out of 10.