CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CVE-2026-76954 and CVE-2026-85101, Synology DSM (SA-26:19): a pre-authentication SQL injection in the Auth API (CVSS 9.8) allows arbitrary file read and write, and an rsync authentication bypass re...

cve · CVE-2026-76954 single-source

Coverage
1
first 2026-11-11 → last 2026-11-11
Latest activity
2026-11-11
Synology DSM: pre-auth SQL injection in the Auth API gives file read and write; update to the fixed build of…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-76954, newest first. Check the date before acting on an older one.

  • Update every Synology DSM to 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 or 7.2.1-69057-13, taking the management interface and rsync of any NAS that is reachable from the internet offline until it is updated, because Synology lists no mitigation for either flaw.
    2026-11-11CVE-2026-76954 +1

Defender insights

What each entry about CVE-2026-76954 tells a defender to do, newest first.

2026-11-11NOTABLESynology DSM: pre-auth SQL injection in the Auth API gives file read and write; update to the fixed build of your branch

Exposure · detection

Story timeline

  1. 2026-11-11CVE-2026-76954 and CVE-2026-85101, Synology DSM (SA-26:19): a pre-authentication SQL injection in the Auth API (CVSS 9.8) allows arbitrary file read and write, and an rsync authentication bypass reads and writes files; fixed in DSM 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13, no mitigation
    trending-vulnerabilitiesSynology DSM: pre-auth SQL injection in the Auth API gives file read and write; update to the fixed build of your branch

Hunting pivots

Affected products
Synology DiskStation Manager (DSM)
Tags
auth-bypasspatch-availablepre-authsqlivulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-11/synology-dsm-sa-26-19-preauth-sqli-auth-api-rsync-bypass · ATT&CK page ↗

Entries about CVE-2026-76954 and CVE-2026-85101, Synology DSM (SA-26:19): a pre-authentication SQL injection in the Auth API (CVSS 9.8) allows arbitrary file read and write, and an rsync authentication bypass re... (1)

2026-11-11 · view entry permalink →

NOTABLECVE-2026-76954 +1NATOA2

CVE-2026-76954 and CVE-2026-85101, Synology DSM (SA-26:19): a pre-authentication SQL injection in the Auth API (CVSS 9.8) allows arbitrary file read and write, and an rsync authentication bypass reads and writes files; fixed in DSM 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13, no mitigation

Synology's advisory SA-26:19 of 2026-11-10, severity Critical, fixes two DiskStation Manager flaws that need no credentials and lists no mitigation (Synology, 2026-11-10). CVE-2026-76954 (CVSS 9.8) is an SQL injection in the Auth API that lets remote attackers read or write arbitrary files and cause denial of service; CVE-2026-85101 (8.6) is an authentication bypass in the rsync service that lets remote attackers read specific files, write arbitrary files and cause limited denial of service (Synology, 2026-11-10). DSM is fixed in 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13 (Synology, 2026-11-10; CERT-FR, 2026-11-10). The sources mention neither exploitation nor a public proof of concept.

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Synology

Builds on: C3RB3R ransomware encrypts Synology NAS; Synology confirms exploitation, 360 names the…

vulnerability11 Nov 03:39Zsingle-sourceOpen finding →
Sources: Synology (security advisory SA-26:19) · CERT-FR (avis CERTFR-2026-AVI-1493)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cert.cyber.gouv.fr1 (50%)
  • synology.com1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)