VULNpocalypse
CriticalVulnerabilityPatch available

Synology discloses DSM flaws incl. critical CVE-2026-76954

Synology says DSM updates fix multiple flaws, including a critical Auth API one; affected DSM owners should upgrade to the fixed builds.

Published
Fixed in
DSM 7.2.1-69057-13, DSM 7.2.2-72806-10, DSM 7.3.2-86009-5, DSM 7.4.1-90080-1 (or above)
Exploitation
No, the sources do not report exploitation; this is not confirmed either way

What happened

According to Synology, it published two security advisories on 2026-11-10, Synology-SA-26:18 and Synology-SA-26:19, for DiskStation Manager (DSM). Both are marked Resolved. HKCERT, a Hong Kong CERT, republished a summary on 2026-11-11 and rates the combined bulletin “Medium Risk”. Synology’s own advisory for the more serious issues is rated Critical, so the two ratings differ. HKCERT

Synology-SA-26:19 covers two flaws. Synology says CVE-2026-76954 is an SQL command neutralization flaw in the Auth API (CVSS3 9.8, Critical). It says remote attackers could read or write arbitrary files and conduct denial-of-service attacks. Synology also says CVE-2026-85101 is an authentication bypass in rsync (CVSS3 8.6, Important). It says remote attackers could read specific files, write arbitrary files and cause limited denial of service. Synology: SA-26:19

Synology-SA-26:18 covers further DSM flaws, rated Important or Moderate by Synology. Its highest CVSS3 score is 8.8, for CVE-2026-13672, CVE-2026-18792 and CVE-2026-74857. Synology describes these as needing a remote authenticated user. Per Synology, the affected components in this set include SSOAuth, the Sharing API, the Auth API, OTP, the VPN API and nfsd. Synology lists the full set of CVEs and their details in the advisory. Synology: SA-26:18

Not confirmed: the sources do not say whether any of these flaws have been exploited. They give no technical exploit detail beyond the advisory descriptions.

Am I affected?

According to Synology, the Critical and Important fixes apply to these DSM releases:

  • DSM 7.4: upgrade to 7.4.1-90080-1 or above.
  • DSM 7.3: upgrade to 7.3.2-86009-5 or above.
  • DSM 7.2.2: upgrade to 7.2.2-72806-10 or above (listed under SA-26:19 only).
  • DSM 7.2.1: upgrade to 7.2.1-69057-13 or above (listed under SA-26:19 only).

HKCERT’s bulletin lists the same four DSM lines as affected. HKCERT Synology lists no mitigation other than upgrading. Synology: SA-26:19 Whether other Synology products are affected is not confirmed in the sources.

What to do now

  1. Check your DSM version and compare it with the fixed builds above.
  2. Read the vendor advisories before installing, as HKCERT advises: SA-26:18 and SA-26:19.
  3. Upgrade to the fixed DSM release for your line. Synology states there is no mitigation.
  4. Whether to restrict network exposure in the meantime is your call. The sources do not recommend it.

Sources