The Exploit Bulletin — Monday, November 9, 2026: 2 issues require action
Monday, November 9, 2026 — 2 issues require action. If you run none of the software below, you are done.
Affects: Synology DiskStation Manager · Eclipse Mosquitto / Home Assistant Mosquitto add-on
1. Insufficient-entropy login flaw in Synology DSM lets unauthenticated attackers read and write arbitrary files (CVE-2026-13639)
PUBLIC EXPLOIT · NO ATTACKS CONFIRMED · DATA EXPOSURE · CRITICAL · CVSS 9.8
A public write-up containing a request-level proof of concept for this unauthenticated DSM flaw was published on 2026-11-08 by Malaysia's MyCERT, so NAS units still on pre-fix builds and reachable from the internet are open to anyone who reproduces it; no attacks against this CVE are confirmed.
Synology DSM's login logic uses insufficient entropy (CWE-331), letting a remote, unauthenticated attacker read or write arbitrary files on the NAS and cause denial of service. The same fixed builds also close CVE-2026-13684, an output-escaping flaw in SCGI with the same unauthenticated file read/write impact.
Affected: Synology DiskStation Manager (DSM) 7.4 before 7.4-90075; Synology DiskStation Manager (DSM) 7.3.2 before 7.3.2-86009-4; Synology DiskStation Manager (DSM) 7.2.2 before 7.2.2-72806-9; Synology DiskStation Manager (DSM) 7.2.1 before 7.2.1-69057-12
How to Test: Compare the installed DSM build against the fixed builds: any 7.2.1 build below 69057-12, 7.2.2 below 72806-9, 7.3.2 below 86009-4, or 7.4 below 90075 is affected. Determine whether the NAS's DSM web interface is reachable from the internet (port forwarding or direct exposure). Review DSM login and web access logs for unexpected logins or requests to the login endpoints from unknown addresses, and check shares and system directories for unexpectedly created, modified, or encrypted files.
How to Patch: Upgrade DSM to 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, or 7.2.1-69057-12 or later, as released in Synology-SA-26:13. Synology lists no mitigation; until the update is applied, remove the DSM web interface from direct internet exposure and restrict access to trusted networks.
Evidence: MyCERT advisory MA-1500.112026 with a request-level proof of concept for the DSM flaw
2. Pre-auth RCE via WebSocket listener heap overflow (Eclipse Mosquitto)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
A detailed technical writeup, posted to r/netsec on 2026-11-08, demonstrates pre-auth RCE against a widely-deployed, network-exposed open-source MQTT broker used by default in Home Assistant, with no CVE assigned and no upstream fix released yet.
A security researcher preparing for Pwn2Own Ireland 2026 found, via fuzzing, a heap out-of-bounds write in Eclipse Mosquitto's packet reassembly code reachable through the built-in MQTT-over-WebSocket listener without authentication. The writeup demonstrates turning this into remote code execution against the Mosquitto add-on running on a Home Assistant Green device; a second post is promised covering container escape to full device compromise. A related GitHub issue had dismissed the bug as having no memory-safety impact. Eclipse has stated a fixed upstream Mosquitto release is expected before 18 November 2026; the Home Assistant Mosquitto add-on was already fixed in version 7.1.2 on 19 October 2026 for the default configuration, though the underlying upstream WebSocket listener issue remains unpatched for other deployments. No CVE has been assigned.
Affected: Eclipse Mosquitto 2.1.0 and later built with WITH_WEBSOCKETS=yes and exposing the WebSocket listener on the network; Home Assistant Mosquitto add-on versions ≤7.1.1 in default configuration (fixed in add-on 7.1.2, released 19 October 2026)
How to Test: Check whether you run Eclipse Mosquitto built with WITH_WEBSOCKETS=yes and whether the WebSocket listener (commonly port 1884) is reachable from untrusted networks; on Home Assistant installations, check the installed Mosquitto add-on version — versions 7.1.1 and earlier in default configuration are affected.
How to Patch: Update the Home Assistant Mosquitto add-on to 7.1.2 or later now. For standalone Eclipse Mosquitto deployments with WebSockets enabled, there is no fixed upstream release yet (expected before 18 November 2026); until then, disable the built-in WebSocket listener if not required, or firewall it to trusted hosts only.
Evidence: Pwning Home Assistant Green: Pre-Auth RCE in Eclipse Mosquitto
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
