CVE-2026-15201

CVSS 5.9 (medium) · published 2026-11-12

An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission.

Weakness: CWE-295

Source: NVD CVE-2026-15201

References

• https://www.synology.com/en-global/security/advisory/Synology_SA_26_18

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.