CVE-2026-15198: Medium severity vulnerability

Published Nov 12, 2026

Updated

A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files and conduct limited denial-of-service attacks.

Event History

Nov 12, 2026

CVE Published

via MITRE·03:34 AM

Data Sourced

via MITRE·03:34 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

Synology DiskStation Manager systems running a version earlier than 7.3.2-86009-5 or 7.4.1-90080-1 are affected if their Webdav API is reachable by a remote attacker.

Does exploitation require credentials or user interaction?

No. The vulnerability is remotely exploitable without authentication or user interaction.

What can an attacker do?

An attacker can read specific files and perform limited denial-of-service attacks. The available information does not indicate that the issue permits modification of data.

CVE-2026-15198: Medium severity vulnerability

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

Does exploitation require credentials or user interaction?

What can an attacker do?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

Does exploitation require credentials or user interaction?

What can an attacker do?