C3RB3R (Cerber) ransomware hits Synology NAS devices through DSM flaws CVE-2026-13639 and CVE-2026-13684
Synology DiskStation Manager (DSM)
Since October 2026, 360's anti-ransomware team has handled multiple ransomware attacks on Synology NAS devices by C3RB3R, a variant of the Cerber ransomware family. 360 says the attackers get in through CVE-2026-13639 (insufficient entropy in DSM login logic) and CVE-2026-13684 (improper output encoding in DSM's SCGI), two critical, unauthenticated remote bugs that Synology fixed on Sep 18 2026 in advisory Synology-SA-26:13. Encrypted files get the .L0CK3D extension and a read-me3.txt ransom note is dropped in each folder. Devices that haven't installed the September DSM update are at risk.
Why this severity: Both CVEs are CVSS 9.8 Critical (Synology), unauthenticated remote file read/write; exploited in a ransomware campaign per 360
- Started
- Oct 1, 2026
Affected
- DSM 7.4 before 7.4-90075
- DSM 7.3 before 7.3.2-86009-4
- DSM 7.2.2 before 7.2.2-72806-9
- DSM 7.2.1 before 7.2.1-69057-12
Fixed in
- DSM 7.4-90075
- DSM 7.3.2-86009-4
- DSM 7.2.2-72806-9
- DSM 7.2.1-69057-12
Timeline2
360 warns that C3RB3R, a Cerber ransomware variant, has been encrypting Synology NAS devices since October through CVE-2026-13639 and CVE-2026-13684, renaming files to .L0CK3D and leaving read-me3.txt ransom notes.
Synology publishes Synology-SA-26:13 (Critical), fixing eight DSM vulnerabilities including CVE-2026-13639 and CVE-2026-13684, which let remote attackers read or write arbitrary files.
Advisories1
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
