EN PT-BR
← Voltar ao feed
high exploit público

CERT-FR Advisory: Multiple Synology Vulnerabilities Enable Remote Code Execution

1 fonte(s) · 1 atualização(ões) · publicado 01/11/2026 21:00 · coletado há 1 hora

The French CERT-FR published advisory CERTFR-2026-AVI-1435 detailing multiple vulnerabilities in Synology products that allow an attacker to achieve remote code execution. Affected components include Mail Station, PHP (versions 7.4.x through 8.4.x), and Synology Calendar, across DSM 6.2, 7.0/7.1, and 7.2 platforms. CERT-FR references Synology's security bulletin Synology_SA_26_14, published 31 October 2026, and two associated CVEs. The advisory follows an earlier CERT-FR alert (CERTFR-2026-ALE-014) issued on 21 October 2026.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1435 reports multiple Synology vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that let an attacker run arbitrary code remotely. They affect Mail Station, the PHP package (7.4.x to 8.4.x) and Synology Calendar on DSM 6.2, 7.0/7.1 and 7.2. The articles do not say which CVE affects which product, nor what access or authentication is needed. Fixed versions include Mail Station 30000002.3.19-0333 (DSM 6.2), -10333 (7.0/7.1) and -20333 (7.2); Calendar 2.4.8-0948, 2.4.8-10948 and 3.0.4-21435 (DSM 7.2); PHP 7.4.33-0131, 8.0.30-0122, 8.1.34-0120, 8.2.35-0171, 8.3.36-0051 and 8.4.27-0051 (DSM 7.2 for 7.4 and 8.0). Earlier DSM builds have their own fixed versions listed in the advisory. Anything older is affected.

Como foi descoberta

The articles do not say who found the flaws or how. Synology published its bulletin Synology_SA_26_14 on 31 October 2026, and CERT-FR issued advisory CERTFR-2026-AVI-1435 on 2 November 2026. CERT-FR had already issued an earlier alert, CERTFR-2026-ALE-014, on 21 October 2026, but the articles do not describe its content or say whether it is related to exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 14:18.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • Impact: remote arbitrary code execution.
  • Affected products: Mail Station (multiple pre-patch version ranges across DSM 6.2/7.0/7.1/7.2), PHP 7.4.x, 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x (pre-patch ranges), Synology Calendar (pre-patch ranges across DSM 6.2/7.0/7.1/7.2).
  • Vulnerabilities: CVE-2026-109618, CVE-2026-109619.
  • Source: Synology security bulletin Synology_SA_26_14, 31 October 2026; prior CERT-FR alert CERTFR-2026-ALE-014, 21 October 2026.

Remediação

  • Apply the patched versions referenced in Synology's security bulletin Synology_SA_26_14.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 01/11/2026 21:00 · coletado 04/11 14:01 primeiro registro

    CERT-FR Advisory: Multiple Synology Vulnerabilities Enable Remote Code Execution

    ler a análise desta fonte

    The French CERT-FR published advisory CERTFR-2026-AVI-1435 detailing multiple vulnerabilities in Synology products that allow an attacker to achieve remote code execution. Affected components include Mail Station, PHP (versions 7.4.x through 8.4.x), and Synology Calendar, across DSM 6.2, 7.0/7.1, and 7.2 platforms. CERT-FR references Synology's security bulletin Synology_SA_26_14, published 31 October 2026, and two associated CVEs. The advisory follows an earlier CERT-FR alert (CERTFR-2026-ALE-014) issued on 21 October 2026.

    Technical Details

    • Impact: remote arbitrary code execution.
    • Affected products: Mail Station (multiple pre-patch version ranges across DSM 6.2/7.0/7.1/7.2), PHP 7.4.x, 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x (pre-patch ranges), Synology Calendar (pre-patch ranges across DSM 6.2/7.0/7.1/7.2).
    • Vulnerabilities: CVE-2026-109618, CVE-2026-109619.
    • Source: Synology security bulletin Synology_SA_26_14, 31 October 2026; prior CERT-FR alert CERTFR-2026-ALE-014, 21 October 2026.

    Remediation

    • Apply the patched versions referenced in Synology's security bulletin Synology_SA_26_14.