This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Synology fixes 3 vulnerabilities
Synology fixes 3 vulnerabilities in Synology MailPlus Server in versions 4.0.1-31663 (for DSM 7.3) and 4.0.1-21663 (for DSM 7.2.2 and 7.2.1) [1].
Allows an unauthenticated remote attacker to read or write arbitrary files and carry out a DoS attack due to improper authorization [1].
The vulnerability is present in product:
- Synology MailPlus Server (DSM); =7.3; =7.2.2; =7.2.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-13136 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 26. 6. 2026.
Allows an unauthenticated attacker from an adjacent network to read or write arbitrary files and carry out a DoS attack due to the use of a cryptographically weak pseudo-random number generator [1].
The vulnerability is present in product:
- Synology MailPlus Server (DSM); =7.3; =7.2.2; =7.2.1
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-15660 at cve.org, NVD
- CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) at cwe.mitre.org
The vulnerability was publicly disclosed 26. 6. 2026.
Allows an unauthenticated remote attacker to access internal services due to improper restriction of the communication channel [1].
The vulnerability is present in product:
- Synology MailPlus Server (DSM); =7.3; =7.2.2; =7.2.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2026-13135 at cve.org, NVD
- CWE-923: Improper Restriction of Communication Channel to Intended Endpoints at cwe.mitre.org
The vulnerability was publicly disclosed 26. 6. 2026.
By CESNET, z.s.p.o. Henrieta Paločková on 26. 6. 2026.