74 openlast updated

HomeOctober 2026 patch cycleSynology DSM SA-24:20: ransomware hits unpatched NAS boxes

Patch nowEnterpriseHomelabfrom 2026-10

Synology DSM SA-24:20: ransomware hits unpatched NAS boxes

Part of October 2026 patch cycle

Vendor
Synology
Products
Synology DSM 7.4, Synology DSM 7.3, Synology DSM 7.2.2, Synology DSM 7.2.1, Synology DSM 7.2, Synology DSM 7.1.1, and Synology DSM 6.2.4
Published
· updated
Status
Open

Update, Nov 2: update to the newest DSM, not just past SA-24:20. Synology still points only to its December 2024 advisory, SA-24:20. One security vendor disagrees about the way in: according to a pwn.watch summary of its report, 360’s anti-ransomware team says the C3RB3R attackers get in through CVE-2026-13639 and CVE-2026-13684, two critical, unauthenticated DSM bugs Synology fixed on Sep 18 in Synology-SA-26:13. Synology hasn’t confirmed that, and we haven’t read 360’s report itself, so treat it as reported, not confirmed. It changes the advice either way: a box that only meets the SA-24:20 minimums below may still be exposed. SA-26:13’s fixed builds are DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12; it lists no fixes for older branches.

How to tell if you’ve been hit: encrypted files get a .L0CK3D extension, and a read-me3.txt ransom note pointing to a “C3rb3r Decryptor” shows up, per BleepingComputer, whose readers started reporting it more than two weeks ago. Shadowserver sees more than 380,000 Synology NAS boxes exposed to the internet, with no count of how many are patched. (BleepingComputer, Synology-SA-26:13, pwn.watch)

Call: Patch now. Synology says attackers are exploiting a vulnerability it patched in December 2024 to encrypt data on NAS boxes running outdated DSM and demand a ransom. If your DSM hasn’t been updated since late 2024, this is about you.

What breaks: Your files get encrypted. Synology points to advisory Synology-SA-24:20, which covers three CVEs: CVE-2024-10441 (rated Critical, remote code execution), CVE-2024-50629 and CVE-2024-10445. Synology doesn’t say which one the attackers use, and we won’t guess.

Who’s hit: DSM older than these fixed releases:

  • DSM 7.2.2: 7.2.2-72806-1
  • DSM 7.2.1: 7.2.1-69057-6
  • DSM 7.2: 7.2-64570-4
  • DSM 7.1.1: 7.1.1-42962-7
  • DSM 6.2.4: 6.2.4-25556-8

Boxes reachable from the internet (port forwards, QuickConnect, exposed DSM web UI) are the obvious targets. Synology hasn’t said how many devices have been hit.

What to do:

  • Update DSM now, to the newest release your model supports. The SA-24:20 builds above are the floor, not the target (see the Nov 2 update).
  • Turn on automatic DSM updates. That’s Synology’s advice too.
  • Take DSM off the internet if you can. Reach it over a VPN instead.
  • Check your backups before you need them. Keep at least one copy that isn’t writable from the NAS: offline, or immutable snapshots with a retention lock.

Sources: Synology press release, Oct 29, Synology-SA-24:20.

Sources

More from October 2026 patch cycle