Synology said in a notice dated 29 October 2026 that it has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DiskStation Manager (DSM), in attacks that aim to encrypt data and extort ransom.

Synology strongly urges all users running vulnerable versions to update DSM immediately, recommends enabling automatic updates, and refers customers to its advisory Synology-SA-24:20.

That advisory, rated Critical by Synology (published 5 Nov 2024, last updated 28 Mar 2025), covers three flaws: CVE-2024-10441 (remote code execution in the system plugin daemon, CVSS 9.8), CVE-2024-50629 (limited file read, 5.3) and CVE-2024-10445 (limited file write, 4.3).

Synology has not said which of the three is being exploited. (source: Synology) According to BleepingComputer, the attacks deploy C3RB3R ransomware, Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, and users are advised to block internet access to the DSM management web interface.