CVE-2026-2237

Medium

Description

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information.

SeverityMedium

CVSS6.2

Exploit probability0. percentile0.1%

ProductSynology Storage Manager

PublishedMay 27, 2026

First seenMay 27, 2026

Weakness typeCWE-598CWE-598

How to fix

Update

synology storage_manager1.0.1-1100 or later

Vendor advisories

synology.com/en-global/security/advisory/Synology_SA_26_01

Affected products

Product	Affected versions	Fixed in
synology storage_manager	v < 1.0.1-1100	1.0.1-1100

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.