Vulnerability intelligence
CVE-2026-40541
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.
CVSS Score
9
Critical
EPSS — Exploit Probability
0.5%
Riskier than 40% of all CVEs · checked 2026-09-09
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
1 article across 1 outlet · first covered May 29, 2026 · latest May 29, 2026
Coverage timeline
-
Critical Patches Fix Synology Chat Server Vulnerabilitiessecurityonline.info · May 29, 2026