In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. Updates

Vulnerability summary

Per the vendor advisory, Synology-SA-24:20 DSM (PWN2OWN 2024), last updated Mar 28, 2025, checked .

CVE
CVE-2024-10441, CVE-2024-50629, CVE-2024-10445
Exploited?
Yes, per Synology. On Oct 29, 2026, Synology said attackers are exploiting a DSM vulnerability patched in December 2024 to encrypt data on devices running outdated DSM, and pointed to Synology-SA-24:20. Synology has not said which of the advisory's three CVEs is being used. None of the three is in CISA's Known Exploited Vulnerabilities catalog (version 2026.10.30, read Nov 3, 2026).

Who is affected and what fixes it

Who is affected and what fixes it, per the vendor advisory
ProductAffectedFixed inSource
DSM 7.2.2Builds before 7.2.2-72806-1 (Critical)7.2.2-72806-1 or aboveSynology-SA-24:20, checked
DSM 7.2.1Builds before 7.2.1-69057-6 (Critical)7.2.1-69057-6 or aboveSynology-SA-24:20, checked
DSM 7.2Builds before 7.2-64570-4 (Critical)7.2-64570-4 or aboveSynology-SA-24:20, checked
DSM 7.1Builds before 7.1.1-42962-7 (Critical)7.1.1-42962-7 or aboveSynology-SA-24:20, checked
DSM 6.2Builds before 6.2.4-25556-8 (Moderate; CVE-2024-10445 only)6.2.4-25556-8 or aboveSynology-SA-24:20, checked

Update checklist

  1. Check the DSM version on every Synology NAS: Control Panel > Info Center > General.
  2. Update to at least the fixed build for your line in Synology-SA-24:20 (table above), or to the latest DSM your model supports.
  3. Synology's advice: turn on automatic DSM updates so the NAS stays current.
  4. Our advice: if an IT provider manages the NAS, ask them in writing for the DSM build on each box and the date it was updated.

If you can't update right away

  • Synology-SA-24:20 lists no mitigation ("None"), so updating is the fix.
  • Our advice: until it's updated, don't leave the DSM sign-in page reachable from the internet. Check Control Panel > External Access > Router Configuration for port-forwarding rules, and remove any you don't need.
  • Our advice: make sure you have a recent backup that isn't stored on the same NAS, and test that it restores.

How to check for compromise

  • BleepingComputer reports victims found a ransom note named read-me3.txt and files renamed with a .L0CK3D extension. If you see either, disconnect the NAS from the network before you do anything else.

Full steps and context: What to do now

TL;DR: Synology says attackers are exploiting a DSM flaw it patched in December 2024 to encrypt data on Synology NAS boxes that never got the update. It points to its advisory Synology-SA-24:20, which covers CVE-2024-10441 (critical, remote code execution), CVE-2024-50629 and CVE-2024-10445. If your NAS runs DSM older than 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8, update it today and turn on automatic updates.

What happened

On October 29, 2026, Synology published a statement saying it “has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom.” DSM (DiskStation Manager) is the operating system on Synology’s NAS storage boxes. Synology urged users on vulnerable versions to update DSM immediately and to turn on automatic updates, and pointed to its advisory Synology-SA-24:20.

BleepingComputer reported on November 2 that the attacks deploy C3RB3R ransomware, following a wave of reports from Synology owners whose files were encrypted. It says victims found a ransom note named read-me3.txt and files with a .L0CK3D extension, and that Shadowserver tracks more than 380,000 Synology NAS devices exposed to the internet.

Synology-SA-24:20 was first published on November 5, 2024, after the Pwn2Own 2024 contest, and last updated on March 28, 2025. Synology rates it Critical and lists three flaws:

  • CVE-2024-10441 (CVSS 9.8, Critical): lets remote attackers run arbitrary code through the system plugin daemon. Synology says it also affects BeeStation (BSM) before 1.1-65374, so update any BeeStation too.
  • CVE-2024-50629 (CVSS 5.3, Moderate): lets remote attackers read limited files through the webapi component.
  • CVE-2024-10445 (CVSS 4.3 per Synology, 5.3 per NVD; Moderate): an update-certificate validation flaw that lets attackers write limited files.

Synology hasn’t said which of the three the attackers use. The fixes for DSM 7.2.2, 7.2 and 7.2.1 shipped in November 2024; the DSM 7.1 fix followed on November 26 and the DSM 6.2 fix on December 5, 2024, per the advisory’s revision history. None of the three CVEs is in CISA’s Known Exploited Vulnerabilities catalog as of version 2026.10.30.

Why it matters

Our read: a NAS is often where a small business keeps its shared files and its backups, so ransomware on it can take out both at once. The fix has been out for almost two years. These attacks work only on boxes nobody updated, which usually means a NAS set up once and then forgotten, or one an old IT provider installed. Our Security hub tracks other flaws under active attack.

What to do now

Our advice: work through these steps in order.

  1. Find every Synology NAS you or your IT provider run, including any at home that holds work files.
  2. Check the DSM version. Sign in to DSM and open Control Panel > Info Center. The General tab shows the DSM version.
  3. Compare it with the fixed builds in Synology-SA-24:20: 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8 and above for each line. Anything older needs updating.
  4. Update DSM to the latest version your model supports, then turn on automatic updates, as Synology recommends.
  5. Take the sign-in page off the internet if you don’t need it there. Info Center’s Service tab and Control Panel > External Access > Router Configuration show which ports are forwarded to the NAS.

Our tip: keep at least one backup that doesn’t live on the NAS, such as an offline drive or a separate cloud account, so ransomware on the box can’t reach it.

Sources & method

Source What it confirms Link
Synology statement (Oct 29, 2026) Attackers exploiting a vulnerability patched in December 2024 against outdated DSM to encrypt data; update now and turn on automatic updates; refers to SA-24:20 Synology
Synology-SA-24:20 (published Nov 5, 2024; updated Mar 28, 2025) Affected DSM lines, fixed builds, severities, the three CVEs with CVSS scores, “Mitigation: None”, revision dates Synology
BleepingComputer (Nov 2, 2026) The news that the attacks use C3RB3R ransomware, the ransom note and file extension, Shadowserver’s 380,000 exposed devices BleepingComputer
NVD records CVSS 9.8 for CVE-2024-10441, 5.3 for CVE-2024-50629, 4.3 (Synology) and 5.3 (NVD) for CVE-2024-10445 NVD
CISA KEV catalog (version 2026.10.30) None of the three CVEs is listed CISA
Synology Knowledge Center: Info Center Control Panel > Info Center > General shows the DSM version Synology

Last checked: Nov 3, 2026, 12:21 p.m. Manila (UTC+8). Method: We read Synology’s Oct 29 statement, Synology-SA-24:20, BleepingComputer’s report, NVD’s records for the three CVEs, CISA’s KEV catalog and Synology’s Info Center help page on Nov 3 between 12:18 and 12:19 p.m. Manila. Versions and fixed builds are quoted from Synology’s advisory. Steps marked “Our tip” or “Our advice” and analysis marked “Our read” are ours, not Synology’s or BleepingComputer’s. The thumbnail is an original OneSignalDesk card summarizing Synology’s advisory. No affiliate links. How we work.

Updates

  • Nov 3, 2026, 12:21 p.m. Manila: First published. We’ll add a dated note if Synology names the exploited CVE or changes the fixed builds.

Spotted an error? See our corrections policy and tell us.