Pierluigi Paganini
November 03, 2026
Synology is warning customers about ransomware attacks targeting its Network Attached Storage (NAS) devices through a vulnerability that the company patched nearly two years ago. The attacks affect devices still running outdated versions of DiskStation Manager (DSM), the operating system used by Synology NAS products.
In a security notice published on October 29, 2026, the Taiwanese company said it had identified attackers exploiting a flaw fixed in December 2024.
“Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom.” reads the advisory. “Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems.”
The announcement doesn’t identify the vulnerability being exploited. However, Synology points users to its security advisory Synology-SA-24:20, published in November 2024, which covers three flaws affecting DSM. The vulnerabilities are CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445.
CVE-2024-10441 is the most severe of the three, with a CVSS score of 9.8. It affects the system plugin daemon and could allow remote code execution. CVE-2024-50629, rated 5.3, could let remote attackers read a limited number of files, while CVE-2024-10445, rated 4.3, involves improper certificate validation in DSM’s update functionality. The available information doesn’t confirm which of these flaws attackers are using in the current attacks. The Hacker News
Synology already addressed the above issues across several DSM versions, including 7.2.2, 7.2.1, 7.2, 7.1 and 6.2. Users should check the security advisory for the fixed build corresponding to their installation rather than assume that having a recent-looking version number is enough. The Hacker News
The campaign also highlights a familiar problem with NAS devices: they often store large amounts of business and personal data, including backups, documents and shared files, but may not receive the same level of attention as servers and endpoints. If attackers encrypt the data stored on a NAS, the impact can extend beyond the device itself, especially when the organization relies on it for backup and recovery.
Synology is urging customers running vulnerable versions to install the available updates immediately. It also recommends enabling automatic updates, reducing the risk that devices remain exposed after security fixes become available.
“Synology also recommends enabling automatic updates to keep DSM up to date at all times.” concludes the advisory.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, NAS)
Malware / November 03, 2026
Malware / November 02, 2026
