# Synology MailPlus Server Multiple Critical Vulnerabilities (CVE-2026-13136, CVE-2025-15660, CVE-2026-13135) — Synology-SA-26:11

> Synology patched three vulnerabilities in MailPlus Server for DiskStation Manager (DSM) 7.3, 7.2.2, and 7.2.1. The most severe, CVE-2026-13136 (CVSS 10.0, CWE-863 Incorrect Authorization), lets unauthenticated remote attackers read/write arbitrary files and cause denial of service. CVE-2025-15660 (CVSS 9.6, CWE-338 weak PRNG) gives adjacent attackers the same file and DoS impact, and CVE-2026-13135 (CVSS 5.3, CWE-923) lets remote attackers reach internal services. Fixed in MailPlus Server 4.0.1-31663 (DSM 7.3) / 4.0.1-21663 (DSM 7.2.2 and 7.2.1); no mitigation exists short of upgrading.

- **Published:** 2026-06-27T00:00:00Z
- **Last reviewed:** 2026-06-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0957
- **ID:** TL-2026-0957
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-13136, CVE-2025-15660, CVE-2026-13135

## Description

On 26 June 2026 Synology published security advisory Synology-SA-26:11 disclosing three vulnerabilities in MailPlus Server, the mail-server package that turns a Synology NAS into private email infrastructure. The advisory bundles two newly assigned 2026 CVEs and one 2025 CVE that was reported through Trend Micro's Zero Day Initiative (ZDI).

The headline issue, CVE-2026-13136, is an Incorrect Authorization weakness (CWE-863) rated CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because of faulty authorization checks, a remote, unauthenticated attacker reaching the MailPlus Server over the network can read and write arbitrary files on the host and trigger denial-of-service conditions. The Scope:Changed metric and the maximum 10.0 score indicate the flaw allows the attacker to break out of MailPlus' security authority and affect resources beyond the vulnerable component — i.e., the underlying DSM host filesystem.

CVE-2025-15660 (tracked by ZDI as ZDI-CAN-28554) stems from use of a cryptographically weak pseudo-random number generator (CWE-338). It is rated CVSS 3.1 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the affected security tokens or identifiers are generated with a predictable PRNG, an attacker on an adjacent network (AV:A) can predict or brute-force those values to read/write arbitrary files and cause DoS, again with Scope:Changed impact on the host.

CVE-2026-13135 (ZDI-CAN-28485) is an Improper Restriction of Communication Channel to Intended Endpoints weakness (CWE-923) rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). A remote attacker can use MailPlus Server as a pivot to reach internal services that should not be exposed, yielding limited confidentiality impact (an SSRF-style internal-service-access primitive).

All three issues affect MailPlus Server running on DSM 7.3, 7.2.2, and 7.2.1. Synology fixed them in MailPlus Server 4.0.1-31663 (for DSM 7.3) and 4.0.1-21663 (for DSM 7.2.2 and 7.2.1). The advisory states there is no available mitigation other than upgrading, making patch deployment the only protective action. As of disclosure, full technical details remained under embargo and no in-the-wild exploitation had been reported, but the exposed attack surface is significant: Bitsight's Groma internet-wide scanning identified over 2,100 internet-facing MailPlus Server deployments, concentrated in Germany, South Korea, China, Taiwan, and the United States. The combination of a CVSS 10.0 unauthenticated arbitrary-file-write/DoS flaw, a large internet-exposed footprint, and no mitigation short of patching makes this an upgrade-driven priority for any SOC protecting Synology MailPlus infrastructure.

Synology credited the discoveries to researcher 'gcali' working with Trend Micro's Zero Day Initiative — which tracked CVE-2025-15660 as ZDI-CAN-28554 and CVE-2026-13135 as ZDI-CAN-28485 — as well as to ABBA Labs. The advisory rated CVE-2026-13136 and CVE-2025-15660 as Critical and CVE-2026-13135 as Moderate. From a defensive standpoint the arbitrary-file-write primitive (CVE-2026-13136 / CVE-2025-15660) is the highest-risk capability: an attacker who can write to the DSM host filesystem could drop a web shell or backdoor for persistence, so file-integrity monitoring of the MailPlus Server and DSM web roots is the key compensating control until patches are applied.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1211 Exploitation for Stealth
- T1110 Brute Force
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1114 Email Collection
- T1210 Exploitation of Remote Services
- T1499 Endpoint Denial of Service
- T1565 Data Manipulation
- T1498 Network Denial of Service

## Sources

- [Synology issues critical fix for MailPlus Server vulnerabilities](https://www.helpnetsecurity.com/2026/06/26/synology-mailplus-server-vulnerabilities/)
- [Synology-SA-26:11 Synology MailPlus Server (Product Security Advisory)](https://www.synology.com/en-global/security/advisory/Synology_SA_26_11)
- [Synology Product Security Advisory Index](https://www.synology.com/en-us/security/advisory)
- [Synology MailPlus Server CVE list (CVE Details)](https://www.cvedetails.com/product/52297/Synology-Mailplus-Server.html?vendor_id=11138)
- [SynoForum discussion: Synology-SA-26:11 Synology MailPlus Server](https://www.synoforum.com/threads/synology-sa-26-11-synology-mailplus-server.16159/)
- [Bitsight Groma Explorer — Synology MailPlus Server observation footprint](https://www.bitsight.com/groma-explorer/synology/mailplusserver/400-31649)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0957