# C3RB3R (Cerber) ransomware hits Synology NAS devices through DSM flaws CVE-2026-13639 and CVE-2026-13684 · pwn.watch

> Since October 2026, 360's anti-ransomware team has handled multiple ransomware attacks on Synology NAS devices by C3RB3R, a variant of the Cerber ransomware family. 360 says the attackers get in through CVE-2026-13639 (insufficient entropy in DSM login logic) and CVE-2026-13684 (improper output encoding in DSM's SCGI), two critical, unauthenticated remote bugs that Synology fixed on Sep 18 2026 in advisory Synology-SA-26:13. Encrypted files get the .L0CK3D extension and a read-me3.txt ransom note is dropped in each folder. Devices that haven't installed the September DSM update are at risk.

Page: https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684 · generated 2026-10-29T10:26:41.039Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Synology DiskStation Manager (DSM)
- Started: 2026-10-01
- CVEs: CVE-2026-13639, CVE-2026-13684
- Affected: DSM 7.4 before 7.4-90075; DSM 7.3 before 7.3.2-86009-4; DSM 7.2.2 before 7.2.2-72806-9; DSM 7.2.1 before 7.2.1-69057-12
- Fixed in: DSM 7.4-90075; DSM 7.3.2-86009-4; DSM 7.2.2-72806-9; DSM 7.2.1-69057-12

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684/feed.xml
- JSON Feed: https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684.json
- This file: https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684/llms.txt

## Updates (newest first)
- 2026-10-29: 360 warns that C3RB3R, a Cerber ransomware variant, has been encrypting Synology NAS devices since October through CVE-2026-13639 and CVE-2026-13684, renaming files to .L0CK3D and leaving read-me3.txt ransom notes. (https://www.360.cn/n/13055.html)
- 2026-09-18: Synology publishes Synology-SA-26:13 (Critical), fixing eight DSM vulnerabilities including CVE-2026-13639 and CVE-2026-13684, which let remote attackers read or write arbitrary files. (https://www.synology.com/en-global/security/advisory/Synology_SA_26_13)

## Fix brief
# Security brief: C3RB3R (Cerber) ransomware hits Synology NAS devices through DSM flaws CVE-2026-13639 and CVE-2026-13684

Source: https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684 · status: live · severity: critical · updated Oct 29, 2026, 08:30 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Since October 2026, 360's anti-ransomware team has handled multiple ransomware attacks on Synology NAS devices by C3RB3R, a variant of the Cerber ransomware family. 360 says the attackers get in through CVE-2026-13639 (insufficient entropy in DSM login logic) and CVE-2026-13684 (improper output encoding in DSM's SCGI), two critical, unauthenticated remote bugs that Synology fixed on Sep 18 2026 in advisory Synology-SA-26:13. Encrypted files get the .L0CK3D extension and a read-me3.txt ransom note is dropped in each folder. Devices that haven't installed the September DSM update are at risk.

Severity detail: Both CVEs are CVSS 9.8 Critical (Synology), unauthenticated remote file read/write; exploited in a ransomware campaign per 360

- Product: Synology DiskStation Manager (DSM)
- CVE / advisory ids: CVE-2026-13639, CVE-2026-13684

## Affected versions
- DSM 7.4 before 7.4-90075
- DSM 7.3 before 7.3.2-86009-4
- DSM 7.2.2 before 7.2.2-72806-9
- DSM 7.2.1 before 7.2.1-69057-12

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- DSM 7.4-90075
- DSM 7.3.2-86009-4
- DSM 7.2.2-72806-9
- DSM 7.2.1-69057-12

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Check the DSM version in Control Panel > Info Center and update to 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 or later. Don't expose the DSM admin interface directly to the internet; use a VPN or Synology's relay instead. Look for files ending in .L0CK3D or read-me3.txt notes, and if you find any, disconnect the NAS and restore from an offline backup.

## Latest updates
- Oct 29, 2026: 360 warns that C3RB3R, a Cerber ransomware variant, has been encrypting Synology NAS devices since October through CVE-2026-13639 and CVE-2026-13684, renaming files to .L0CK3D and leaving read-me3.txt ransom notes.
- Sep 18, 2026: Synology publishes Synology-SA-26:13 (Critical), fixing eight DSM vulnerabilities including CVE-2026-13639 and CVE-2026-13684, which let remote attackers read or write arbitrary files.

## Advisories
- [Synology-SA-26:13 DSM](https://www.synology.com/en-global/security/advisory/Synology_SA_26_13) (Synology)

## Write-ups & news
- [Cerber勒索攻击群晖NAS事件预警](https://www.360.cn/n/13055.html)

---
Machine-readable: https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.