PT-2026-43592 · Synology · Storage Manager

Simon Baaske · CVE-2026-2237 · Published 2026-05-27 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Synology Storage Manager versions prior to 1.0.1-1100

Description A flaw in the volume encryption component allows local attackers to obtain sensitive information. This occurs because the application uses the GET request method with sensitive query strings, which can lead to information disclosure.

Recommendations Update to version 1.0.1-1100 or later.

Fix

Weakness Enumeration

CWE-598

Related Identifiers

CVE-2026-2237

Affected Products

Storage Manager

References · 4

• https://synology.com/en-global/security/advisory/Synology_SA_26_01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2237 · Security Note
• https://t.me/cveNotify/165531 · Telegram Post
• https://twitter.com/dailycve/status/2061594246885277986 · Twitter Post