Synology MailPlus Server Critical Remote Code Execution and Arbitrary File Access (CVE-2026-13136, CVE-2025-15660, CVE-2026-13135)
Synology MailPlus Server Critical Remote Code Execution and (TL-2026-1014), also tracked as Synology MailPlus Server Path Traversal, is a critical-severity software vulnerability scored CVSS 10, first published 2026-06-30. It has no confirmed attribution, affects Synology MailPlus Server, references 3 CVEs (CVE-2026-13136, CVE-2025-15660, CVE-2026-13135), maps to 24 MITRE ATT&CK techniques (T1005, T1012, T1036), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-1014
- Threat ID
- TL-2026-1014
- Also known as
- Synology MailPlus Server Path Traversal, Synology MailPlus Server Arbitrary File Write
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-30
- Last reviewed
- 2026-06-30
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- health, finance, government administration, education, technology, manufacturing
- Target regions
- North America, Europe, Asia-Pacific, Middle East, Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Synology MailPlus Server Critical Remote Code Execution and
Malware and tooling: WebShell.MailPlus, MailPlus-RCE-POC
Three critical vulnerabilities in Synology MailPlus Server affect DSM 7.3, 7.2.2, and 7.2.1. CVE-2026-13136 (CVSS 10.0) enables unauthenticated remote attackers to read/write arbitrary files and trigger denial-of-service attacks. CVE-2025-15660 (CVSS 9.6) allows adjacent-network attackers to manipulate critical files. CVE-2026-13135 (CVSS 5.3) permits unauthorized access to internal services.
How Synology MailPlus Server Critical Remote Code Execution and works
Synology MailPlus Server contains three distinct vulnerability chains that collectively enable complete system compromise. The primary vulnerability, CVE-2026-13136, is a critical path traversal and arbitrary file write vulnerability accessible to unauthenticated attackers over the network without any authentication requirement. The vulnerability stems from insufficient input validation in HTTP request handlers for file upload and management functionality. Attackers can craft specially-formed HTTP requests containing path traversal sequences (e.g., ../) to bypass directory restrictions and write arbitrary files to any location on the system with MailPlus Server process privileges. The secondary vulnerability, CVE-2025-15660, affects network-adjacent attackers and permits manipulation of configuration files and mail storage, potentially leading to credential theft and mailbox compromise. CVE-2026-13135 is an information disclosure vulnerability that exposes internal service endpoints and administrative APIs to unauthenticated access. Combined, these vulnerabilities enable attackers to: (1) achieve remote code execution by writing malicious scripts to accessible web directories or cron job locations; (2) manipulate mail storage and user configurations; (3) steal credentials and session tokens from configuration files; (4) enumerate internal infrastructure and services; (5) trigger denial-of-service through resource exhaustion or critical file corruption.
MITRE ATT&CK techniques used in TL-2026-1014
Collection
T1005 Data from Local System; T1074 Data Staged; T1114 Email Collection
Discovery
T1012 Query Registry; T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal
exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056 Input Capture; T1552 Unsecured Credentials
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
Privilege Escalation
T1134 Access Token Manipulation
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1485 Data Destruction; T1490 Inhibit System Recovery; T1491 Defacement; T1499 Endpoint Denial of Service
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
privilege-escalation
T1548 Abuse Elevation Control Mechanism
Lateral Movement
Affected products and versions in Synology MailPlus Server Critical Remote Code Execution and
- Synology — MailPlus Server
Vulnerable versions: 4.0.0-xxxx to 4.0.1-31662 on DSM 7.3; All versions on DSM 7.2.2; All versions on DSM 7.2.1
Fixed in: 4.0.1-31663+ on DSM 7.3; 4.0.1-31663+ on DSM 7.2.2; 4.0.1-31663+ on DSM 7.2.1 - Synology — DiskStation Manager (DSM)
Vulnerable versions: 7.3; 7.2.2; 7.2.1
Fixed in: 7.3 with MailPlus 4.0.1-31663+; 7.2.2 with MailPlus 4.0.1-31663+; 7.2.1 with MailPlus 4.0.1-31663+
Remediation for Synology MailPlus Server Critical Remote Code Execution and
Patches
- Apply Synology MailPlus Server 4.0.1-31663 or later for DSM 7.3
- Apply equivalent security patch for MailPlus Server on DSM 7.2.2 and DSM 7.2.1
- Patch DSM operating system to the latest stable release
Immediate actions
- Block MailPlus Server ports 25, 110, 143, 587, 993, 995 at network perimeter if service is not required
- Isolate MailPlus Server on a dedicated VLAN with network segmentation from user workstations
- Disable HTTP/HTTPS administrative interfaces if not required; restrict to VPN/bastion access only
- Monitor HTTP error logs for path traversal patterns: ../, ..\, %2e%2e, ..%5c, etc.
- Review MailPlus Server process logs for unusual file creation in system directories
Workarounds
- Disable MailPlus Server service entirely if not critical to operations
- Restrict network access to MailPlus Server ports via firewall rules (whitelist only trusted IPs)
- Run MailPlus Server in a restricted container with read-only filesystem
Longer-term hardening
- Upgrade to MailPlus Server 4.0.1-31663 or later on DSM 7.3 (or equivalent patched version for 7.2.x)
- Deploy application-level Web Application Firewall (WAF) rules to block path traversal attacks
- Implement file integrity monitoring (FIM) on MailPlus Server directories (/var/packages/MailPlus, /home/mailserver, /var/www)
- Enable audit logging for all file write operations in MailPlus Server
- Implement least-privilege file permissions: restrict MailPlus Server process to read-only for system files
- Deploy behavioral detection for process spawn from mail service process
CVEs associated with Synology MailPlus Server Critical Remote Code Execution and
CVE-2026-13136, CVE-2025-15660, CVE-2026-13135
Weaknesses (CWE) in Synology MailPlus Server Critical Remote Code Execution and
CWE-22, CWE-426, CWE-434, CWE-552, CWE-640
Timeline of Synology MailPlus Server Critical Remote Code Execution and
- Synology security team discovers critical vulnerabilities in MailPlus Server during internal security audit or external vulnerability disclosure
- Synology completes patch development for MailPlus Server 4.0.1-31663 addressing CVE-2026-13136, CVE-2025-15660, and CVE-2026-13135
- Synology publicly releases security advisories and patches for MailPlus Server vulnerabilities; cyber security news outlets report the vulnerabilities
- MailPlus Server 4.0.1-31663 becomes widely available; DSM 7.3, 7.2.2, and 7.2.1 users can apply security updates
- Threat intelligence community begins analysis and documentation of exploitation techniques; detection rules are developed
- Initial exploitation attempts expected as threat actors begin scanning for unpatched MailPlus Server instances on the internet
- First confirmed exploitation attempts detected in the wild; SOC alerts and incident reports begin to accumulate
- Mass scanning campaigns targeting MailPlus Server port ranges (25, 110, 143, 587, 993, 995) observed across internet-facing systems
- First self-propagating worm variant using CVE-2026-13136 detected attempting to compromise adjacent MailPlus Server instances on corporate networks
Sources cited for Synology MailPlus Server Critical Remote Code Execution and
- Synology MailPlus Server Vulnerabilities Advisory
- Cyber Security News: Synology MailPlus Server Vulnerabilities
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory
- MITRE ATT&CK: Abuse Elevation Control Mechanism
- CWE-426: Untrusted Search Path
- OWASP Path Traversal Vulnerability
- NVD CVE-2026-13136 Entry
- NVD CVE-2025-15660 Entry
- NVD CVE-2026-13135 Entry
- Synology DiskStation Manager Security Releases
- CISA Vulnerability Alerts and Advisories
- Path Traversal Techniques in Network Applications
- Synology MailPlus Server Documentation
- HTTP Request Smuggling and Path Traversal in Web Servers
- File Upload Vulnerabilities and Restrictions Bypass
Threats related to Synology MailPlus Server Critical Remote Code Execution and
Detection coverage for TL-2026-1014
As of 2026-06-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1014 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.