Synology published a notice from Taipei on 29 October 2026. It is four sentences long, and here is effectively all of it: the company has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM, the attacks aim to encrypt data and extort a ransom, users on vulnerable versions should update immediately, and automatic updates are recommended. For more information, it says, refer to advisory Synology-SA-24:20.

That is the entire public record from the vendor.

Count what is missing

No CVE is named. No affected version numbers are given, and no fixed ones either. There is no count of devices, no estimate of how many customers are affected, no malware family, no initial access detail beyond the word vulnerability, and no actor.

The only two figures on the page are the two dates. Both quotable sentences are advice rather than information.

Advisory SA-24:20 covers three CVEs, CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445. The notice does not say which one is being used, or whether it is one of them at all.

Which is why nobody agrees on what is happening

Secondary reporting has filled the gap in different directions. Some of it attaches the attacks to the three CVEs in SA-24:20. Other reporting ties them instead to two DSM flaws disclosed in September 2026, CVE-2026-13639 and CVE-2026-13684, which is a different advisory, a different year and a different patch. The ransomware is widely called C3RB3R, a name the vendor does not use.

None of those links is confirmed by Synology, and a reader cannot settle it from the primary source because the primary source declines to say.

That matters operationally. An administrator who wants to know whether they are exposed cannot answer the question from the notice. They can only update, which is good advice and not the same thing as information.

The catalogue check

We went and looked rather than taking anyone's word for it, in the Known Exploited Vulnerabilities catalogue as released on 3 November, 1,767 entries.

None of the five candidate CVEs is in it. Not the three from SA-24:20, not the two from September 2026.

Then we searched the whole file by vendor, and the result is the line worth keeping: Synology has never had a single entry in the catalogue. Not this year, not any year, for any product, across all 1,767 entries.

Hold those two facts together

A vendor is publicly telling its customers that criminals are encrypting their data through a flaw it patched two years ago. The United States federal catalogue of vulnerabilities known to be exploited has never listed one of that vendor's products.

There are innocent readings. The catalogue binds federal agencies, and consumer and small-business network storage is not standard federal kit, so a flaw can be heavily exploited in homes and small offices without ever crossing CISA's threshold. Nothing here suggests the catalogue is wrong.

But it is a useful reminder of what the catalogue is and is not. It is a federal remediation instrument, not a census of what criminals are exploiting. Anyone using KEV membership as a proxy for real-world risk in a consumer or small-business estate is reading a map of somebody else's territory.

It also means that in this case the only warning a Synology owner will get is the one the vendor chose to write, and the vendor chose to write four sentences.

What to do

  • Update DSM now, and turn on automatic updates. Both are the vendor's own advice and both are right.
  • Get the management interface off the internet. A NAS answering from the public internet is the precondition for almost every incident of this type.
  • Check that your backups are not mounted on the device being backed up. Ransomware on a NAS reaches whatever the NAS can write to.
  • Do not rely on KEV membership to decide whether consumer or small-business gear is under attack. This case is the counter-example.
  • If you manage these for clients, ask the vendor directly which CVE is in use. Enough people asking is how four-sentence notices get longer.

What is not established

  • Which vulnerability is being exploited. The vendor names none, and the reporting disagrees.
  • How many devices have been hit. No count exists anywhere.
  • Who is behind it. The vendor names no actor and no malware family.
  • Whether the attacks and the September 2026 advisories are connected at all.
  • Why a flaw patched in December 2024 is producing a notice in October 2026. The gap is unexplained.