Synology MailPlus: Three Critical CVEs, 2,100+ Servers Exposed

Synology released MailPlus Server 4.0.1-31663 to fix three critical vulnerabilities enabling arbitrary file read/write and internal service access. No alternative mitigations exist; technical details remain under wraps.

Synology released MailPlus Server 4.0.1-31663 on June 26, 2026, to address three critical vulnerabilities that expose thousands of self-hosted email servers to remote compromise. The update is the only defense available: the source explicitly states no alternative mitigations exist for the patched flaws, while technical details remain unpublished.

Key Takeaways

Three CVEs identified: CVE-2026-13136, CVE-2026-13135, and CVE-2025-15660, with impact ranging from arbitrary file read/write to internal service access and DoS.
The fix is MailPlus Server version 4.0.1-31663, published for DiskStation Manager v7.3, 7.2.2, and 7.2.1.
Bitsight detects over 2,100 internet-facing deployments, concentrated in Germany, South Korea, China, Taiwan, and the U.S.
Technical details of the vulnerabilities are still under wraps, per the source.

What the Update Fixes and Who Is at Risk

MailPlus Server 4.0.1-31663 closes three distinct vulnerability classes. CVE-2026-13136 stems from faulty authorization checks and allows remote arbitrary file read/write and denial of service. CVE-2026-13135 exploits improper communication channel restriction to permit remote access to internal services. CVE-2025-15660, the only one with a prior publication date, roots in a cryptographically weak pseudo-random number generator and enables arbitrary file read/write and DoS in adjacent attacker contexts.

Affected OS versions are DSM v7.3, v7.2.2, and v7.2.1. The absence of a direct Synology advisory makes it impossible to independently verify the full attack surface.

Internet-Facing Exposure: A Figure to Verify

"Details about the vulnerabilities are still under wraps." — Help Net Security

According to the source, Bitsight via its Groma Explorer engine detects over 2,100 MailPlus Server deployments directly exposed to the internet. Geographic distribution shows concentrations in Germany, Asia (South Korea, mainland China, Taiwan), and the United States.

The number, however, supports a precise operational reading: email servers on consumer and entry-level enterprise NAS, often managed by small businesses or IT departments without dedicated security teams, represent a high-attack-surface target. The combination of internet-facing exposure and no alternative mitigations turns theoretical risk into immediate risk.

Synology's Silence: A Non-Standard Practice

The most significant angle in the dossier is procedural, not technical. Synology, a NAS vendor with a global install base spanning decades, has not published a structured advisory with CVSS advisory with CVSS scores, discovery timeline, researcher identities, and attack condition details. The news circulates exclusively through third-party editorial sources, with technical information deliberately fragmented.

This disclosure mode diverges from enterprise vendors like Cisco or Fortinet, which publish advisories with explicit CVSS, ATT&CK matrices, indicators of compromise, and, when relevant, confirmation or denial of in-the-wild exploitation. The consequence for users is a verifiable trust deficit: without a primary vendor advisory, urgency assessment for patching remains mediated by third-party interpretations.

Caution is warranted here: absence of confirmation does not equal absence of exploitation, but it does not justify undocumented claims either.

Why This Matters

The dossier documents no corrective measures beyond updating to version 4.0.1-31663. The source explicitly states "there is no available mitigation for the fixed issues," ruling out workarounds, alternative configurations, or firewall rules as substitutes for the patch.

The source does not identify the researchers who discovered the vulnerabilities, does not provide a responsible disclosure timeline, and does not report CVSS scores for any of the three CVEs. These limits, combined with the absence of a direct vendor advisory, reduce users' ability to prioritize this update against other maintenance tasks.

Questions and Answers

Why is no CVSS score available?

The CVE identifiers are assigned, but numerical severity has not been published by the consulted source. It cannot be determined whether Synology communicated this data internally to select entities.

Can I delay the update if the server is not internet-exposed?

The remote attack condition for CVE-2026-13136 and CVE-2026-13135 suggests internet exposure amplifies danger, but the source does not rule out internal network attack scenarios or compromise via other assets.

What happens if technical details become public?

The source notes details are "still under wraps." Their future publication could lower the barrier to automated exploitation, especially for servers that do not receive timely patches.

Sources

Sources and references

Get DeafLetter