CVE-2026-76954 and CVE-2026-85101, Synology DSM (SA-26:19): a pre-authentication SQL injection in the Auth API (CVSS 9.8) allows arbitrary file read and write, and an rsync authentication bypass reads and writes files; fixed in DSM 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13, no mitigation
Synology DSM: pre-auth SQL injection in the Auth API gives file read and write; update to the fixed build of your branch
Defender actions
- Update every Synology DSM to 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 or 7.2.1-69057-13, taking the management interface and rsync of any NAS that is reachable from the internet offline until it is updated, because Synology lists no mitigation for either flaw.
Analysis
Synology's advisory SA-26:19 of 2026-11-10, severity Critical, fixes two DiskStation Manager flaws that need no credentials and lists no mitigation (Synology, 2026-11-10). CVE-2026-76954 (CVSS 9.8) is an SQL injection in the Auth API that lets remote attackers read or write arbitrary files and cause denial of service; CVE-2026-85101 (8.6) is an authentication bypass in the rsync service that lets remote attackers read specific files, write arbitrary files and cause limited denial of service (Synology, 2026-11-10). DSM is fixed in 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13 (Synology, 2026-11-10; CERT-FR, 2026-11-10). The sources mention neither exploitation nor a public proof of concept.
Cited evidence
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Sources2
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.