Synology has confirmed that attackers are breaking into DiskStation Manager (DSM) installations that never received a fix it published in December 2024, and encrypting the data on those devices for ransom. The flaw is CVE-2024-10441, a 9.8-rated remote code execution bug first demonstrated at Pwn2Own 2024.
What happened
The bug sits in the DSM system plugin daemon, where output was not properly encoded or escaped. A remote attacker with no credentials can use it to run code on the appliance. Synology rates it CVSS 9.8 with an attack vector of network, no privileges and no user interaction, which is about as exposed as a vulnerability gets.
On 29 October 2026, Synology published a short notice stating that threat actors are now exploiting this exact flaw against devices on outdated DSM builds, and that the attacks encrypt data and then demand payment. The company did not publish victim counts, ransom figures or indicators of compromise.
The fix has been available since late 2024 and was backported across the DSM 6.2, 7.1 and 7.2 branches. The gap between patch availability and exploitation here is roughly two years, which is the whole story: this is not a new bug, it is an unpatched one.
Who is affected
Any Synology appliance still on a DSM build older than the fixed releases below, and any BeeStation on an old BeeStation OS build.
- DSM 7.2.2 before 7.2.2-72806-1
- DSM 7.2.1 before 7.2.1-69057-6
- DSM 7.2 before 7.2-64570-4
- DSM 7.1 before 7.1.1-42962-7
- DSM 6.2 before 6.2.4-25556-8
- BeeStation OS before 1.1-65374
Exposure rises sharply for any NAS with DSM reachable from the internet, whether by port forwarding, UPnP or a quick-connect style relay that was never reviewed.
What to do now
Check the DSM build number on every Synology appliance you manage today, and upgrade anything behind the fixed versions above before you do anything else.
- Log in to DSM, open Control Panel, then Update and Restore, and read the exact build string rather than trusting an automatic-update setting.
- Upgrade to the current release for your branch, then turn automatic updates on so this does not repeat.
- Close DSM, SSH, WebDAV and File Station to the internet. Publish them through a VPN or a reverse proxy with MFA in front.
- Verify that a recent, offline or immutable backup exists before you patch. A NAS that is both the file server and the only backup is a single ransomware event away from total loss.
- If the device was internet-facing on an old build, treat the data as potentially accessed. Review DSM logs for unknown admin accounts and scheduled tasks, and rotate credentials stored on the appliance.
What this means for South African businesses
A Synology box is the most common shared-folder and backup target we see in small and mid-sized South African offices, and it is almost always set up once and then forgotten. That is precisely the profile this campaign targets: an appliance holding the company's files and its backup copies, running firmware from two years ago.
My read is that the risk here is underweighted because a NAS does not feel like a server. It sits in a cupboard, nobody owns it, and its update prompt gets dismissed. In practice it is often the highest-value single device on the network, because it holds everything and is frequently the ransomware recovery path as well.
Source: Synology security notice, 29 October 2026, and advisory Synology-SA-24:20.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.