Synology Active Backup For Business Agent vulnerabilities

8 CVEs affecting Synology Active Backup For Business Agent, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-66592, published 2026-05-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-47264, published 2025-02-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and…
CVE-2024-47266, published 2025-02-13. Low severity, CVSS 2.7. EPSS: 0.5% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234…
CVE-2024-47265, published 2025-02-13. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup for Business before 2.7.1-13234,…
CVE-2023-52949, published 2024-09-26. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential…
CVE-2023-52947, published 2024-09-26. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via…
CVE-2025-66592, published 2026-05-27. Medium severity, CVSS 5.6. EPSS: 0.1% chance of exploitation in the next 30 days. An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct…
CVE-2023-52948, published 2024-09-26. Medium severity, CVSS 5.0. EPSS: 0.1% chance of exploitation in the next 30 days. Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via…
CVE-2023-52950, published 2024-09-26. Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days. Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user…