{
  "slug": "synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684",
  "category": "patch",
  "title": "C3RB3R (Cerber) ransomware hits Synology NAS devices through DSM flaws CVE-2026-13639 and CVE-2026-13684",
  "summary": "Since October 2026, 360's anti-ransomware team has handled multiple ransomware attacks on Synology NAS devices by C3RB3R, a variant of the Cerber ransomware family. 360 says the attackers get in through CVE-2026-13639 (insufficient entropy in DSM login logic) and CVE-2026-13684 (improper output encoding in DSM's SCGI), two critical, unauthenticated remote bugs that Synology fixed on Sep 18 2026 in advisory Synology-SA-26:13. Encrypted files get the .L0CK3D extension and a read-me3.txt ransom note is dropped in each folder. Devices that haven't installed the September DSM update are at risk.",
  "cveIds": [
    "CVE-2026-13639",
    "CVE-2026-13684"
  ],
  "product": "Synology DiskStation Manager (DSM)",
  "stacks": [],
  "tags": [
    "synology",
    "dsm",
    "nas",
    "ransomware",
    "cerber",
    "exploited"
  ],
  "severity": "critical",
  "severityNote": "Both CVEs are CVSS 9.8 Critical (Synology), unauthenticated remote file read/write; exploited in a ransomware campaign per 360",
  "status": "live",
  "startedAt": "2026-10-01",
  "patchStatus": "patched",
  "affectedVersions": [
    "DSM 7.4 before 7.4-90075",
    "DSM 7.3 before 7.3.2-86009-4",
    "DSM 7.2.2 before 7.2.2-72806-9",
    "DSM 7.2.1 before 7.2.1-69057-12"
  ],
  "fixedVersions": [
    "DSM 7.4-90075",
    "DSM 7.3.2-86009-4",
    "DSM 7.2.2-72806-9",
    "DSM 7.2.1-69057-12"
  ],
  "timeline": [
    {
      "date": "2026-09-18",
      "title": "Synology publishes Synology-SA-26:13 (Critical), fixing eight DSM vulnerabilities including CVE-2026-13639 and CVE-2026-13684, which let remote attackers read or write arbitrary files.",
      "sourceUrl": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_13"
    },
    {
      "date": "2026-10-29",
      "title": "360 warns that C3RB3R, a Cerber ransomware variant, has been encrypting Synology NAS devices since October through CVE-2026-13639 and CVE-2026-13684, renaming files to .L0CK3D and leaving read-me3.txt ransom notes.",
      "sourceUrl": "https://www.360.cn/n/13055.html"
    }
  ],
  "grouping": "none",
  "sources": [
    {
      "kind": "advisory",
      "title": "Synology-SA-26:13 DSM",
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_13",
      "publisher": "Synology",
      "date": "2026-09-18"
    },
    {
      "kind": "news",
      "title": "Cerber勒索攻击群晖NAS事件预警",
      "url": "https://www.360.cn/n/13055.html",
      "publisher": "360",
      "date": "2026-10-29"
    }
  ],
  "tweets": [],
  "agentNotes": "Check the DSM version in Control Panel > Info Center and update to 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 or later. Don't expose the DSM admin interface directly to the internet; use a VPN or Synology's relay instead. Look for files ending in .L0CK3D or read-me3.txt notes, and if you find any, disconnect the NAS and restore from an offline backup.",
  "updatedAt": "2026-10-29T08:30:22Z",
  "xPost": {
    "id": "2115724066384748790",
    "postedAt": "2026-10-29T08:35:00.641Z",
    "url": "https://x.com/pwnwatch_app/status/2115724066384748790"
  },
  "url": "https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684",
  "json": "https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684.json",
  "sections": [],
  "agentBrief": "# Security brief: C3RB3R (Cerber) ransomware hits Synology NAS devices through DSM flaws CVE-2026-13639 and CVE-2026-13684\n\nSource: https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684 · status: live · severity: critical · updated Oct 29, 2026, 08:30 UTC\n\n## Patch status\n**PATCHED: fixed releases exist. Upgrade to a fixed version.**\n\n## What it is\nSince October 2026, 360's anti-ransomware team has handled multiple ransomware attacks on Synology NAS devices by C3RB3R, a variant of the Cerber ransomware family. 360 says the attackers get in through CVE-2026-13639 (insufficient entropy in DSM login logic) and CVE-2026-13684 (improper output encoding in DSM's SCGI), two critical, unauthenticated remote bugs that Synology fixed on Sep 18 2026 in advisory Synology-SA-26:13. Encrypted files get the .L0CK3D extension and a read-me3.txt ransom note is dropped in each folder. Devices that haven't installed the September DSM update are at risk.\n\nSeverity detail: Both CVEs are CVSS 9.8 Critical (Synology), unauthenticated remote file read/write; exploited in a ransomware campaign per 360\n\n- Product: Synology DiskStation Manager (DSM)\n- CVE / advisory ids: CVE-2026-13639, CVE-2026-13684\n\n## Affected versions\n- DSM 7.4 before 7.4-90075\n- DSM 7.3 before 7.3.2-86009-4\n- DSM 7.2.2 before 7.2.2-72806-9\n- DSM 7.2.1 before 7.2.1-69057-12\n\n## Check whether you're affected\nNo generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.\n\n## Fix\nUpgrade to one of these fixed versions (or later on the same branch):\n- DSM 7.4-90075\n- DSM 7.3.2-86009-4\n- DSM 7.2.2-72806-9\n- DSM 7.2.1-69057-12\n\nAfter upgrading, re-run the checks above and redeploy/restart the affected services.\n\n## Specific notes\nCheck the DSM version in Control Panel > Info Center and update to 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 or later. Don't expose the DSM admin interface directly to the internet; use a VPN or Synology's relay instead. Look for files ending in .L0CK3D or read-me3.txt notes, and if you find any, disconnect the NAS and restore from an offline backup.\n\n## Latest updates\n- Oct 29, 2026: 360 warns that C3RB3R, a Cerber ransomware variant, has been encrypting Synology NAS devices since October through CVE-2026-13639 and CVE-2026-13684, renaming files to .L0CK3D and leaving read-me3.txt ransom notes.\n- Sep 18, 2026: Synology publishes Synology-SA-26:13 (Critical), fixing eight DSM vulnerabilities including CVE-2026-13639 and CVE-2026-13684, which let remote attackers read or write arbitrary files.\n\n## Advisories\n- [Synology-SA-26:13 DSM](https://www.synology.com/en-global/security/advisory/Synology_SA_26_13) (Synology)\n\n## Write-ups & news\n- [Cerber勒索攻击群晖NAS事件预警](https://www.360.cn/n/13055.html)\n\n---\nMachine-readable: https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems."
}