CVE-2026-40537

Executive Summary

CVE-2026-40537 is a server-side request forgery (SSRF) vulnerability in the PersonMail API component of Synology DiskStation Manager (DSM). The flaw allows a remote, authenticated attacker to coerce the affected DSM host into making server-side HTTP requests, resulting in the disclosure of non-sensitive information. Organisations running unpatched DSM builds (before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2) are exposed, though the low CVSS score (4.3) reflects the requirement for authentication and the limited confidentiality impact described by the vendor.

Technical Analysis

The vulnerability is classified as CWE-918: Server-Side Request Forgery (SSRF). SSRF arises when an application accepts a user-controllable input that it uses to construct or select a URL for a server-side fetch, without adequately validating the destination. Because the request originates from the DSM server itself, it traverses network boundaries, trust zones, and allow-lists that the original client could not reach directly.

In this specific case, the affected component is the PersonMail API within DSM. Per the NVD description, exploitation requires the attacker to already hold valid credentials on the DSM instance ("remote authenticated users"). This authentication requirement is the primary reason the CVSS base score is limited to 4.3 with PR:L (Privileges Required: Low) and C:L (Confidentiality: Low). The description explicitly states that only non-sensitive information can be obtained, which constrains the severity of any data disclosure — this is not a credential-theft or full-read-compromise primitive.

Attack surface characteristics:

• Network vector (AV:N): The PersonMail API is reachable over the network, consistent with DSM's web-facing administrative and package interfaces. Exploitation does not require local access.
• No user interaction (UI:N): The attacker does not need to lure a victim; they drive the request directly through the API.
• Unchanged scope (S:U): The vulnerable component and the resources it can access are treated as a single security authority, meaning the SSRF can reach resources reachable by the DSM service account but does not formally cross an authorisation boundary per the CVSS model.
• No availability or integrity impact: I:N/A:N reflect that this is a read-only information disclosure primitive — the server initiates outbound requests but does not mutate its own state or downstream data.

Because the NVD description does not disclose the specific request parameter, endpoint path, or protocol scheme used, all downstream detection content in this report is derived at the vulnerability-class level (SSRF via an authenticated DSM API) rather than from confirmed implementation details. No public PoC, Nuclei template, or exploit code was identified by the tracked sources.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-40537; the following attack chain is inferred strictly from the SSRF vulnerability class and the constraints stated in the NVD description (authenticated, PersonMail API, non-sensitive information disclosure).

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Synology DSM instance running an affected build (before 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2). Fingerprinting leverages the DSM web interface and its version banner. Sites can be enumerated via Shodan dorks such as http.title:"Synology" or http.html:"DiskStation".

2. Authentication. The attacker obtains or already possesses a low-privileged DSM account. This is the gating precondition per the NVD description ("remote authenticated users"). Credentials may come from prior phishing, credential stuffing, or an internal actor with baseline access to the NAS.

3. Triggering the flaw. Once authenticated, the attacker sends a crafted request to the PersonMail API that supplies an attacker-chosen destination URL. The API, failing to validate or restrict the destination, causes the DSM server to issue the outbound HTTP(S) request on the attacker's behalf. The precise parameter name and endpoint path are not disclosed in the NVD description; the attacker's goal at this stage is to make the server fetch an arbitrary target controlled or specified by the attacker.

4. Information retrieval / post-exploitation. Because the vulnerable component returns data it fetched, the attacker can read responses from internal-only services (localhost, RFC1918 addresses, or cloud metadata endpoints where applicable) that are reachable from the DSM host but not from the attacker. The impact is capped at non-sensitive information disclosure per the vendor, aligning with C:L. The primitive is read-only — no modification or denial of service is described.

Note: This is a low-complexity (AC:L), single-step flaw once the authentication precondition is met. Its value to an attacker is primarily as a pivot/reconnaissance primitive rather than as a direct compromise vector.

Impact Assessment

• Confidentiality (C:L): Limited disclosure of non-sensitive information. No credentials, cryptographic material, or full file-system reads are described.
• Integrity (I:N) / Availability (A:N): No impact stated.
• Privileges Required (PR:L): An authenticated account is mandatory, reducing the pool of eligible attackers to those with DSM credentials.
• Scope (S:U): The SSRF does not formally escape the vulnerable component's security authority.
• Blast radius: Any Synology DSM host on an affected build is potentially vulnerable. This includes internet-exposed consumer/SMB NAS devices and enterprise DSM deployments. In flat internal networks, the DSM host may be able to reach management interfaces, internal APIs, or cloud instance metadata, making even "non-sensitive" disclosure valuable for mapping attack surfaces.

Business framing: while the standalone severity is low, the flaw is a useful reconnaissance pivot. In combination with lateral-movement tooling, it can enrich a broader intrusion. The absence of exploit code and its non-KEV status mean real-world exploitation is currently unlikely to be widespread, but defenders should not deprioritise it in environments where DSM is internet-facing.

Detection Guidance

Sigma Rule

title: Potential SSRF via Synology DSM PersonMail API (CVE-2026-40537)
id: 8f3b2c41-7d9e-4a10-b6c2-1a9d0e5f7c33
status: experimental
description: Detects authenticated requests to the Synology DSM PersonMail API carrying external or internal URL parameters that may indicate SSRF abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-40537
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: synology
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/webapi/'
      - 'PersonMail'
  selection_ssrf_indicator:
    cs-uri-query|contains:
      - 'http://'
      - 'https://'
      - '127.0.0.1'
      - 'localhost'
      - '169.254.169.254'
      - 'file://'
      - 'gopher://'
  condition: selection_endpoint and selection_ssrf_indicator
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate API calls referencing external URLs by design
level: medium

YARA Rule

rule CVE_2026_40537_SSRF_Synology_DSM
{
    meta:
        description = "Detects SSRF abuse attempts against Synology DSM PersonMail API (CVE-2026-40537)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-40537"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $api = "PersonMail" ascii nocase
        $webapi = "/webapi/" ascii nocase
        $s1 = "169.254.169.254" ascii
        $s2 = "127.0.0.1" ascii
        $s3 = "localhost" ascii nocase
        $s4 = "gopher://" ascii nocase
        $s5 = "file://" ascii nocase
        $scheme = "http" ascii nocase

    condition:
        uint16(0) != 0x5A4D and
        filesize < 5MB and
        ($api or $webapi) and
        2 of ($s*) and $scheme
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-40537 Possible SSRF in Synology DSM PersonMail API"; flow:established,to_server; http.uri; content:"PersonMail"; nocase; http.uri; pcre:"/(https?%3A%2F%2F|https?:\/\/)/i"; http.uri; pcre:"/(127\.0\.0\.1|localhost|169\.254\.169\.254|gopher%3A|file%3A)/i"; reference:cve,2026-40537; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-40537; classtype:web-application-attack; sid:202640537; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where event.action == "network_flow" and
     url.path : "*PersonMail*" and
     url.query : ("*127.0.0.1*", "*localhost*", "*169.254.169.254*", "*gopher*", "*file://*")]

Splunk SPL Query

index=web sourcetype=synology:dsm OR sourcetype=access_combined
| search uri_path="*PersonMail*" 
| where match(uri_query, "(?i)(http(s)?%3A%2F%2F|127\.0\.0\.1|localhost|169\.254\.169\.254|gopher|file%3A)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip user uri_path uri_query
| sort - count

Wazuh OSSEC Rule

<group name="web,synology,ssrf,">
  <rule id="100537" level="10">
    <if_sid>31100</if_sid>
    <match>PersonMail</match>
    <regex>127\.0\.0\.1|localhost|169\.254\.169\.254|gopher|file://</regex>
    <description>CVE-2026-40537: Possible SSRF via Synology DSM PersonMail API</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_40537,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The version numbers cited in the NVD description (7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2) are treated as the vendor-implied fixed builds, but this report could not corroborate them against a live vendor advisory.

1. Immediate mitigations

   • Restrict network access to DSM: do not expose DSM management or package APIs to the internet. Enforce access via VPN or a reverse proxy with authentication.
   • Apply least privilege to DSM accounts; audit and remove dormant accounts that could satisfy the PR:L precondition.
   • If PersonMail is not required, disable the package or block its API endpoints at the reverse proxy/WAF.
   • Add egress filtering so that DSM hosts cannot reach attacker-controlled external endpoints or internal management planes unnecessarily.

2. Patch / upgrade steps

   • Update DSM to a build at or above the fixed versions named in the NVD description for the applicable release track: 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2.
   • Verify the installed build via DSM Control Panel → Info Center after upgrade.
   • Because patch confidence is 0/4, independently confirm the fix against Synology's official security advisory before closing the ticket.

3. Long-term hardening

   • Maintain an asset inventory of internet-exposed NAS devices with automated version tracking.
   • Enforce MFA and strong authentication on all DSM accounts.
   • Deploy the detection content above and monitor for URL parameters containing internal/loopback addresses or uncommon schemes.
   • Adopt a vulnerability management cadence that treats even low-CVSS SSRF bugs as reconnaissance-relevant and prioritises them on internet-facing assets.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-40537
• Synology Product Security Advisory — https://www.synology.com/en-global/security/advisory (verify the specific advisory for PersonMail / DSM)
• CWE-918: Server-Side Request Forgery — https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-40537 not listed as of this writing) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild evidence: No exploit-in-the-wild activity, public PoC, or threat-actor campaign is associated with CVE-2026-40537 based on the data provided. EPSS has not been scored by FIRST.org. The report reflects an SSRF-class assessment only.