[MZ-25-02] Synology Active Backup for Microsoft 365

ID: MZ-25-02

Release: June 27, 2025

Credits: Leonid Hartmann

The standalone disclosure report can be found here. The full details are published in our blog post.

Other News

DISCLOSURE
When Backups Open Backdoors: Accessing Sensitive Cloud Data via "Synology Active Backup for Microsoft 365"
June 27, 2025
A credential leaked by Synology allowed anyone unauthorized access to sensitive data of all Microsoft cloud tenants using “Active Backup for Microsoft 365” (ABM).

ADVISORY
[MZ-25-01] Via Browser for Android
February 27, 2025
Via Browser was affected by a universal Cross-Site Scripting (uXSS) issue