CVE-2026-15201: Medium severity vulnerability

Published Nov 12, 2026

Updated

An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission.

Event History

Nov 12, 2026

CVE Published

via MITRE·03:35 AM

Data Sourced

via MITRE·03:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker must be in a man-in-the-middle position during a Support Form submission. Exploitation also requires a user to submit the Support Form.

Which DSM versions are affected?

DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected.

What could a successful attacker do?

A man-in-the-middle attacker can read arbitrary files and write specific files during the Support Form submission process.

CVE-2026-15201: Medium severity vulnerability

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which DSM versions are affected?

What could a successful attacker do?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which DSM versions are affected?

What could a successful attacker do?