Synology Chat Server vulnerabilities

3 CVEs affecting Synology Chat Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-9548, published 2026-08-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-40541, published 2026-08-28. Critical severity, CVSS 9.0. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users,…
CVE-2026-9491, published 2026-08-28. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information.
CVE-2026-9548, published 2026-08-28. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users,…