Secuno
ENNL
Book demo

CVE-2026-13684

9.8 CRITICAL
  1. Published18 Sept 2026

Description

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-541828.1
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a…
CVE-2026-546949.6
SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two…
CVE-2026-815228.1
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace…
CVE-2026-618248.2
Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate…
CVE-2026-613989.1
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while…
CVE-2025-516779.1
An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between…

Frequently asked

Is CVE-2026-13684 being actively exploited?

CVE-2026-13684 is not in the CISA KEV catalog.

How severe is CVE-2026-13684?

CVE-2026-13684 has a CVSS 3.1 base score of 9.8, rated critical.

How do I fix CVE-2026-13684?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-13684 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.