Synology-SA-26:19 DSM

Publish Time: 2026-11-10 17:06:42 UTC+8

Last Updated: 2026-11-10 17:06:42 UTC+8

Severity: Critical

Status: Resolved

Abstract

Synology has released a security update for the DSM to address multiple vulnerabilities :

CVE-2026-76954 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-85101 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.

Affected Products

Product	Severity	Fixed Release Availability
DSM 7.4	Critical	Upgrade to 7.4.1-90080-1 or above.
DSM 7.3	Critical	Upgrade to 7.3.2-86009-5 or above.
DSM 7.2.2	Critical	Upgrade to 7.2.2-72806-10 or above.
DSM 7.2.1	Critical	Upgrade to 7.2.1-69057-13 or above.

Mitigation

None

Detail

CVE-2026-76954
- Severity: Critical
- CVSS3 Base Score: 9.8
- CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command
- An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-85101
- Severity: Important
- CVSS3 Base Score: 8.6
- CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
- CWE-288: Authentication Bypass Using an Alternate Path or Channel
- An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.

Acknowledgement

Nguyễn Bá Nam Dũng (@greengrass19000) and Hà Thế Long (LongHT) from Viettel Cyber Security Research Lab (@vcslab)
Warisse Valentin (Aytio)

Revision

Revision	Date	Description
1	2026-11-10	Initial public release.