CVE-2021-26562: Synology Diskstation Manager

High severity, CVSS 8.1. EPSS: 1.9% chance of exploitation in the next 30 days.

Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via syno_finder_site HTTP header.

Affected products

• Synology Diskstation Manager: before 6.2.3-25426-3 (fixed in 6.2.3-25426-3)
• Synology Diskstation Manager Unified Controller: version 3.0 only
• Synology Skynas Firmware: affected versions not specified
• Synology VS960HD Firmware: affected versions not specified

Published 2021-02-26. Last modified 2026-06-17.