A critical DSM vulnerability on Synology NAS devices has been patched

Synology published two separate security advisories for DiskStation Manager (DSM) on November 10 and fixed a total of 27 vulnerabilities. SA-26:19 is marked critical, while SA-26:18 is marked important. Synology’s own note offers no mitigation; the only fix is to update DSM.

A 9.8-rated SQL flaw in the Auth API

The most severe entry in the advisory is CVE-2026-76954. Improper sanitization of special characters in SQL commands in DSM’s Auth API creates a vulnerability that can be exploited remotely and without any authentication. Its CVSS 3.1 score is 9.8, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In other words, an attacker can use a single network request to read arbitrary files on the server, write arbitrary files, and carry out a denial-of-service attack.

CVE-2026-85101 in the same advisory is based on an authentication bypass in the rsync component (8.6). Through this flaw, certain files can also be read, arbitrary files can be written, and a limited service disruption can be caused. Synology disclosed both vulnerabilities while thanking Viettel Cyber Security researchers Nguyễn Bá Nam Dũng and Hà Thế Long, as well as Warisse Valentin (Aytio).

Three 8.8 flaws and a privilege escalation chain

The SA-26:18 advisory covers 25 entries. The highlights are:

CVE-2026-13672 (8.8) — authorization bypass via a user-controlled key in the SSOAuth component. A logged-in user can gain access to other accounts’ data.

CVE-2026-18792 (8.8) — missing directory restriction in the Sharing API; a logged-in user can break out of the root directory and read and write files.

CVE-2026-74857 (8.8) — bypassing the authentication step in the Auth API leads to the same result.

Alongside these, there’s an authentication bypass in the OTP component (CVE-2026-18596, 8.1), symbolic link following during thumbnail generation (CVE-2026-19048, 8.1), and SQL injection in the User API (CVE-2026-81584, 8.1). The last one requires an attacker who controls a compromised LDAP or Active Directory server.

Among the medium-severity entries, uninitialized pointer access in nfsd (CVE-2026-18633, 7.5, denial of service), OS command injection in the VPN API (CVE-2026-75785, 7.2, requires admin privileges), and missing authentication in the Webdav API (CVE-2026-15198, 6.5) stand out. Because the Webdav flaw does not require authentication, it may be considered the second riskiest issue for internet-exposed DSM installations.

Which versions are affected

Synology has released fixed versions for four DSM branches:

• DSM 7.2.1 → 7.2.1-69057-13 or later
• DSM 7.2.2 → 7.2.2-72806-10 or later
• DSM 7.3 → 7.3.2-86009-5 or later
• DSM 7.4 → 7.4.1-90080-1 or later

To update, follow Control Panel → Update & Restore → DSM Update in the DSM interface. If the device is on the automatic update channel, the new version should appear shortly; if not, trigger the update manually and restart DSM after installation.

What to do after updating

Some of these vulnerabilities do not require authentication. So don’t leave DSM’s management interface (5000/5001) and services like WebDAV and rsync directly exposed to the internet; use VPN or QuickConnect for remote access. Enable two-step verification on the admin account, disable the default “admin” account, and monitor login attempts through the logs.

Synology did not share any information in these advisories indicating active exploitation, but the fact that the Auth API flaw does not require login and that patched versions are now available is enough to make devices that delay updating likely targets in short order. Home or small office NAS devices often run for weeks without updates; this time, it’s best not to put it off.

Source: Synology PSIRT · NVD