Synology Security Synology-SA-26:10 Synology Chat Server

[Synology RSS]

Synology has released a security update for the Synology Chat Server package in DSM to address multiple vulnerabilities : CVE-2026-40541 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks. CVE-2026-9491 allows remote authenticated users to obtain non-sensitive information. CVE-2026-9548 allows remote authenticated users to read or write restricted files and conduct limited denial-of-service attacks. Please refer to the 'Affected Products' table for the corresponding updates.

Continue reading...
- - -
Synology Product Security Advisory: check the list

Source: synology.com

 

[fredbert]

All three vulnerabilities require remote authenticated users. Also, the remediation is to install Chat server v2.4.5-22148 which was released back on February 2026... so hopefully that has been on your update tasks in the past three months. Fixes are for v7.2.1 and later.