Synology warns ransomware is hitting DSM left unpatched since 2024

Synology warns ransomware is hitting DSM left unpatched since 2024

29 October 2026: Synology says criminals are exploiting a vulnerability it patched in December 2024 to encrypt and extort Synology NAS devices that still run old versions of DiskStation Manager (DSM). The company is urging every owner of an affected version to update at once and to turn on automatic updates, and points to its advisory Synology-SA-24:20.

Not yet independently verified. Synology's release does not name the CVE the attackers use; it points to SA-24:20, which lists three. Synology gives no count of affected devices and no indicators of compromise. We will update this when it can be confirmed, and remove this note.

The advisory behind the warning

SA-24:20 covers flaws shown at the Pwn2Own contest in 2024. Its critical bug, CVE-2024-10441 (CVSS 3.1 score 9.8), is an output-encoding flaw in DSM's system plugin daemon that lets a remote attacker run arbitrary code with no login and no user action. Two moderate flaws ship with it: CVE-2024-50629 (5.3) in the web API, which lets a remote attacker read limited files, and CVE-2024-10445 (4.3) in the update function, which lets an attacker on the same network write limited files because certificates are not checked properly.

Synology's release does not say which of the three the attackers use. CVE-2024-10441 is the only one that allows code execution from the network, but the company has not confirmed it.

Which DSM builds are safe

The advisory lists these minimum releases:

• DSM 7.2.2: 7.2.2-72806-1 or later
• DSM 7.2.1: 7.2.1-69057-6 or later
• DSM 7.2: 7.2-64570-4 or later
• DSM 7.1: 7.1.1-42962-7 or later
• DSM 6.2: 6.2.4-25556-8 or later (moderate flaws only)

BeeStation OS before 1.1-65374 is affected too. The advisory gives no mitigation other than updating.

Why boxes are still exposed two years on

The fixes were rolled out between November and December 2024, so any NAS on these builds has missed nearly two years of updates. That usually means a device bought for a small office or a branch, set up once and left alone, often reachable from the internet through QuickConnect, port forwarding or a published file-sharing address. On 31 October Synology also extended its PHP2Shell fixes in SA-26:14 to older DSM releases, another reason to bring neglected units up to date.

Owners should check the DSM version under Control Panel, update, and then confirm that backups held on the NAS are also copied somewhere the NAS cannot overwrite, since an encrypted NAS that holds the only backup copy loses both. Synology has a profile on TrustList; our backup software category lists four products.

Related on TrustList:

• Synology adds PHP2Shell fixes for older DSM, but not for PHP 7.3
• Veeam fixes a critical authorization bypass in Backup & Replication 13
• Veeam fixes three code-execution flaws in its System Center pack

Sources

• Synology: Synology urges users to update DSM following ransomware attacks on outdated DSM versions, 29 October 2026
• Synology: Synology-SA-24:20 DSM (PWN2OWN 2024), last updated 28 March 2025, 28 March 2025