CVE-2026-40533: Medium severity Synology DiskStation Manager (DSM) vulnerability
An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information.
Affected Software
Event History
Frequently Asked Questions
Which DSM releases need to be updated?
DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 are affected. Systems running one of those named fixed releases or a later release within the applicable branch are not identified as affected.
Does exploitation require authentication or user interaction?
No. The vulnerability is remotely exploitable with no privileges and no user interaction required, according to the supplied vector.
What is the expected impact if exploited?
The stated impact is disclosure of non-sensitive information through data queries in the DSM Desktop API. The supplied vector indicates low confidentiality impact and no integrity or availability impact.