pwned.coffeeOrder ticket · today's special · 3 Nov 2026

🔥 On the fly · exploited in the wildScalding · 540°CcriticalOrder up · fix available

QNAP Systems HBS 3: remote code execution (exploited)

QNAP Systems HBS 3

Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.

Do this now

Upgrade to HBS 3 16.0.0415, HBS 3 v3.0.210411, DiskStation Manager 7.4-90075, plus 7 more lines in Fix it.

Who should check: teams running Homelab apps

Fix it

HBS 3

On 3.xUpgrade to HBS 3 v3.0.210411
On 16.xUpgrade to HBS 3 16.0.0415

DiskStation Manager (DSM)

On 6.2.4.xUpgrade to DiskStation Manager (DSM) 6.2.4-25556-8
On 7.1.1.xUpgrade to DiskStation Manager (DSM) 7.1.1-42962-7
On 7.2.1.xUpgrade to DiskStation Manager (DSM) 7.2.1-69057-12
On 7.2.2.xUpgrade to DiskStation Manager (DSM) 7.2.2-72806-9
On 7.2.64570.xUpgrade to DiskStation Manager (DSM) 7.2-64570-4
On 7.3.2.xUpgrade to DiskStation Manager (DSM) 7.3.2-86009-4
On 7.4.90075.xUpgrade to DiskStation Manager (DSM) 7.4-90075

BeeStation OS (BSM)

Upgrade to BeeStation OS (BSM) 1.1-65374

Not affected: HBS 2, HBS 1.3 (CVE record)

First seen: 3 Nov 2026
Last update: 6 Nov 2026, 19:18 UTC
Fixed in: HBS 3 16.0.0415
HBS 3 v3.0.210411
DiskStation Manager (DSM) 7.4-90075
DiskStation Manager (DSM) 7.3.2-86009-4
DiskStation Manager (DSM) 7.2-64570-4
DiskStation Manager (DSM) 7.2.2-72806-9
DiskStation Manager (DSM) 7.2.1-69057-12
DiskStation Manager (DSM) 7.1.1-42962-7
DiskStation Manager (DSM) 6.2.4-25556-8
BeeStation OS (BSM) 1.1-65374
Identifiers: CVE-2021-28799
CVE-2024-10441
CVE-2024-10445
CVE-2024-50629
CVE-2026-13639
CVE-2026-13684
CVSS: 9.8
Source: news
On the menu as: Homelab apps

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## QNAP Systems HBS 3: remote code execution (exploited)
Severity: critical, exploited in the wild. Patch status: patched.
Affected: QNAP Systems HBS 3
Fixed in: HBS 3 16.0.0415, HBS 3 v3.0.210411, DiskStation Manager (DSM) 7.4-90075, DiskStation Manager (DSM) 7.3.2-86009-4, DiskStation Manager (DSM) 7.2-64570-4, DiskStation Manager (DSM) 7.2.2-72806-9, DiskStation Manager (DSM) 7.2.1-69057-12, DiskStation Manager (DSM) 7.1.1-42962-7, DiskStation Manager (DSM) 6.2.4-25556-8, BeeStation OS (BSM) 1.1-65374
Ids: CVE-2021-28799, CVE-2024-10441, CVE-2024-10445, CVE-2024-50629, CVE-2026-13639, CVE-2026-13684

Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.

## Steps
1. This touches infrastructure (self-hosted). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: HBS 3: 16.0.0415; v3.0.210411. DiskStation Manager (DSM): 7.4-90075; 7.3.x → 7.3.2-86009-4; 7.2-64570-4; 7.2.x → 7.2.2-72806-9; 7.2.x → 7.2.1-69057-12; 7.1.1-42962-7; 6.2.4-25556-8. BeeStation OS (BSM): 1.1.x → 1.1-65374.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| HBS 3 | fixed | 16.0.0415 | — |
| HBS 3 | fixed | v3.0.210411 | — |
| DiskStation Manager (DSM) | fixed | 7.4-90075 | — |
| DiskStation Manager (DSM) 7.3.x | fixed | 7.3.2-86009-4 | — |
| DiskStation Manager (DSM) | fixed | 7.2-64570-4 | — |
| DiskStation Manager (DSM) 7.2.x | fixed | 7.2.2-72806-9 | — |
| DiskStation Manager (DSM) 7.2.x | fixed | 7.2.1-69057-12 | — |
| DiskStation Manager (DSM) | fixed | 7.1.1-42962-7 | — |
| DiskStation Manager (DSM) | fixed | 6.2.4-25556-8 | — |
| BeeStation OS (BSM) 1.1.x | fixed | 1.1-65374 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2021-28799") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.synology.com/en-global/company/news/article/C3RB3R/Synology%20urges%20users%20to%20update%20DSM%20following%20ransomware%20attacks%20on%20outdated%20DSM%20versions https://www.synology.com/en-global/security/advisory/Synology_SA_26_13 https://www.synology.com/zh-tw/security/advisory/Synology_SA_24_20
https://pwned.coffee/i/synology-nas-devices-targeted-in-ransomware-attacks-exploiting-patched-d

Timeline

6 Nov 2026, 18:18 UTC
Fix status: unknown → patched.
3 Nov 2026
First reported.

Receipt

Exploitation: Exploited: listed in CISA KEV
CISA KEV “CVE-2021-28799 added to CISA KEV on 2022-03-31, federal deadline 2022-04-21.” source
Fix by release line: Product Affected Fixed in Source
HBS 3 before 16.0.0415 16.0.0415 CVE record (CNA) checked 7 Nov
HBS 3 before v3.0.210411 v3.0.210411 CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM) before 7.4-90075 7.4-90075 CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM) 7.3.2 to before 7.3.2-86009-4 7.3.2-86009-4 CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM) before 7.2-64570-4 7.2-64570-4 CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM) 7.2.2 to before 7.2.2-72806-9 7.2.2-72806-9 CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM) 7.2.1 to before 7.2.1-69057-12 7.2.1-69057-12 CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM) before 7.1.1-42962-7 7.1.1-42962-7 CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM) before 6.2.4-25556-8 6.2.4-25556-8 CVE record (CNA) checked 7 Nov
BeeStation OS (BSM) 1.1 to before 1.1-65374 1.1-65374 CVE record (CNA) checked 7 Nov
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (NVD) for CVE-2021-28799
Last checked: 7 Nov 2026, 18:18 UTC

Product	Affected	Fixed in	Source
HBS 3	before 16.0.0415	16.0.0415	CVE record (CNA) checked 7 Nov
HBS 3	before v3.0.210411	v3.0.210411	CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM)	before 7.4-90075	7.4-90075	CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM)	7.3.2 to before 7.3.2-86009-4	7.3.2-86009-4	CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM)	before 7.2-64570-4	7.2-64570-4	CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM)	7.2.2 to before 7.2.2-72806-9	7.2.2-72806-9	CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM)	7.2.1 to before 7.2.1-69057-12	7.2.1-69057-12	CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM)	before 7.1.1-42962-7	7.1.1-42962-7	CVE record (CNA) checked 7 Nov
DiskStation Manager (DSM)	before 6.2.4-25556-8	6.2.4-25556-8	CVE record (CNA) checked 7 Nov
BeeStation OS (BSM)	1.1 to before 1.1-65374	1.1-65374	CVE record (CNA) checked 7 Nov

Sources: KEV ✓ CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee