Synology published security advisory Synology-SA-26:19 for DiskStation Manager (DSM) on 10 November 2026 at 17:06:42 UTC+8, which is 11:06:42 Asia/Jerusalem (UTC+2). The advisory is revision 1, "Initial public release," and Synology last updated it at the same timestamp. Synology rates the advisory Critical and marks its status Resolved.
The advisory covers CVE-2026-76954 and CVE-2026-85101, closed by the same DSM builds:
- CVE-2026-76954, which Synology rates Critical (CVSS 3.1 9.8): "An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks."
- CVE-2026-85101, which Synology's advisory labels Important and scores CVSS 3.1 8.6: "An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks." Synology's CVE record lists that same 8.6 score as High.
Synology's mitigation line is "None." The published remediation is to upgrade to the fixed build for that DSM train, or a later build. Synology, as CNA, published the CVE records on 12 November 2026: CVE-2026-85101 at 03:40:28 UTC (05:40:28 Asia/Jerusalem) and CVE-2026-76954 at 03:41:52 UTC (05:41:52 Asia/Jerusalem).
Neither CVE was in CISA's Known Exploited Vulnerabilities catalog as of catalogVersion 2026.11.10, checked 12 November 2026 at 10:18 Asia/Jerusalem UTC+2. The advisory does not discuss exploitation in the wild. This post makes no exploitation claim.
Technical Information
CVE-2026-76954. Synology rates it Critical, CVSS 3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: reachable over the network, with no privileges required and no user interaction. Synology's CVE record lists CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The flaw is in the DSM Auth API. Synology's impact wording is that remote attackers can read or write arbitrary files and conduct denial-of-service attacks. This post does not recharacterize that impact.
Synology's CVE record for CVE-2026-76954 credits Nguyễn Bá Nam Dũng (@greengrass19000) and Hà Thế Long (LongHT) from Viettel Cyber Security Research Lab (@vcslab).
CVE-2026-85101. Synology's advisory labels it Important and publishes CVSS 3.1 8.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. Synology's CVE record lists the same score as High. The record lists CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The flaw is in rsync in DSM. Synology's impact wording is that remote attackers can read specific files, write arbitrary files, and conduct limited denial-of-service attacks.
Synology's CVE record for CVE-2026-85101 credits Warisse Valentin (Aytio). The advisory lists both credits under a single Acknowledgement heading and does not assign them to a CVE; the split above follows the CVE records.
What the advisory does not say. Synology does not describe the injection or bypass path, which files are in reach, or whether a successful file write leads to code execution. This post does not fill those gaps. NVD lists both records as Received as of the 10:18 Asia/Jerusalem check on 12 November 2026 and currently shows Synology's CVSS 3.1 scores (metric type Primary in the NVD API response). NVD has not published a separate NVD-generated score.
Affected Product Versions
From Synology-SA-26:19. The advisory lists DSM 7.4, 7.3, 7.2.2, and 7.2.1, all at Critical severity, and does not list other DSM trains, Synology Router Manager, or other Synology products. Synology's CVE records mark versions before 7.2.1 as unknown; this post does not treat those older trains as affected or as safe.
| Product | Severity (advisory) | Fixed release, as Synology states |
|---|---|---|
| DSM 7.4 | Critical | Upgrade to 7.4.1-90080-1 or above |
| DSM 7.3 | Critical | Upgrade to 7.3.2-86009-5 or above |
| DSM 7.2.2 | Critical | Upgrade to 7.2.2-72806-10 or above |
| DSM 7.2.1 | Critical | Upgrade to 7.2.1-69057-13 or above |
Both CVEs share those fixed builds. A system already running the listed build, or a later build on the same train, is outside the affected ranges Synology published.
Exploitation Status
Synology-SA-26:19 does not discuss exploitation, customer impact, or proof-of-concept code. CVE-2026-76954 and CVE-2026-85101 were not in CISA's Known Exploited Vulnerabilities catalog as of catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29.8375Z (21:03:29 Asia/Jerusalem), count 1779, checked 12 November 2026 at 10:18 Asia/Jerusalem UTC+2. This post makes no exploitation claim.
Workaround and Mitigation
Synology's mitigation for this advisory is "None." The published remediation is to upgrade DSM to the fixed release for that train, or a later build. Until a system is on a fixed build, restricting DSM management, the Auth API, and rsync so they are not reachable from the internet — for example to a VPN or an internal network — is Rescana guidance, not a vendor workaround, and it does not replace the upgrade.
Indicators of Compromise
Synology-SA-26:19 publishes no indicators of compromise or detection guidance for these CVEs, and this post does not supply any.
What to Ask Your Suppliers and MSPs Today
Synology NAS devices often hold backups and shared files for suppliers. They have also been a ransomware target: on 29 October 2026 Synology warned that threat actors were exploiting a vulnerability patched in December 2024 against outdated DSM, and pointed users to Synology-SA-24:20, as we covered in our post on the C3RB3R ransomware wave. An unpatched NAS is a high-value system to get onto a current, vendor-fixed build. This advisory is a new issue, not an update of that post.
Ask suppliers that may run Synology DSM, in writing:
- Do they run Synology DSM, and on which train and build?
- Is DSM management or the Auth API reachable from the internet, and is rsync exposed?
- When will they be on the fixed build for their train — 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10, or 7.2.1-69057-13, or later — or can they confirm they already are?
Until they have upgraded, ask them to restrict DSM to a VPN or an internal network (Rescana guidance, not a Synology workaround). If you operate DSM yourself, apply Synology's fixed build first, then confirm the same points against your inventory.
Need help working through suppliers that run Synology DSM and may be exposed to CVE-2026-76954 or CVE-2026-85101? Our team can help you prioritize them and track their answers. Talk to an expert
Sources
- Synology-SA-26:19 DSM — publish time and last updated 2026-11-10 17:06:42 UTC+8 (11:06:42 Asia/Jerusalem UTC+2); revision 1, initial public release; advisory severity Critical, status Resolved; mitigation None; fixed builds 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10, and 7.2.1-69057-13. Rechecked 12 November 2026 at 10:18 Asia/Jerusalem UTC+2.
- CVE-2026-76954 (CNA Synology; CVE List JSON) — published 2026-11-12T03:41:52.523Z (05:41:52 Asia/Jerusalem); CVSS 3.1 9.8 Critical; CWE-89; Auth API SQL injection; credit Nguyễn Bá Nam Dũng and Hà Thế Long, Viettel Cyber Security Research Lab. Versions before 7.2.1 marked unknown.
- CVE-2026-85101 (CNA Synology; CVE List JSON) — published 2026-11-12T03:40:28.897Z (05:40:28 Asia/Jerusalem); CVSS 3.1 8.6 High (advisory label Important); CWE-288; rsync authentication bypass; credit Warisse Valentin (Aytio). Versions before 7.2.1 marked unknown.
- NVD CVE-2026-76954 and NVD CVE-2026-85101 — both vulnStatus Received as of the NVD API timestamp 2026-11-12T08:18:50 (10:18 Asia/Jerusalem); Synology CVSS 3.1 scores shown, metric type Primary; no separate NVD-generated score.
- CISA vulnerability catalog JSON feed — catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29.8375Z (21:03:29 Asia/Jerusalem), count 1779; CVE-2026-76954 and CVE-2026-85101 are not in CISA KEV as of 12 November 2026 at 10:18 Asia/Jerusalem UTC+2.
- Synology newsroom statement, 29 October 2026 — Synology warned that threat actors were exploiting a vulnerability patched in December 2024 against outdated DSM and pointed users to Synology-SA-24:20. The statement does not name a ransomware family.
- Synology DSM Ransomware Wave (C3RB3R) — prior Rescana coverage of Synology-SA-24:20 / C3RB3R against outdated DSM; different incident, not this advisory.
