I’M UNDER A CYBER ATTACK

Alert

Logo de Synology

Alert 2026-157 Unauthenticated SQL injection in the Synology DSM Auth API

Affected product(s): 

ProductAffected versionsFixed in
DSM 7.4Earlier than 7.4.1-90080-17.4.1-90080-1 or later
DSM 7.3Earlier than 7.3.2-86009-57.3.2-86009-5 or later
DSM 7.2.2Earlier than 7.2.2-72806-107.2.2-72806-10 or later
DSM 7.2.1Earlier than 7.2.1-69057-137.2.1-69057-13 or later

The advisory names only those four DSM branches. The official release notes assign a date of Oct 12, 2026 to at least 7.4.1-90080 Update 1, 7.3.2-86009 Update 5, and 7.2.1-69057 Update 13; 7.2.2-72806 Update 10 has no printed date on the pages consulted.

Description

The Synology-SA-26:19 security advisory has been published, fixing two vulnerabilities in Synology DiskStation Manager (DSM). The advisory was made public on Nov 10, 2026 at 06:06 (PYT). This bulletin is warranted by the publication of those identifiers, not because the fixed builds were announced on that day.

The more serious vulnerability is CVE-2026-76954, an SQL injection in the Auth API. According to the vendor, a remote attacker without credentials can read or write arbitrary files and cause a denial of service. The vendor assigns it a CVSS 3.1 score of 9.8, critical, and labels the advisory overall as Critical. The second, CVE-2026-85101, is an authentication bypass through an alternative path or channel in rsync, with a CVSS 3.1 score of 8.6, high (the vendor classifies it as Important): it allows reading specific files, writing arbitrary files, and causing a limited denial of service.

The DSM 7.4, 7.3, 7.2.2, and 7.2.1 branches are affected prior to builds 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10, and 7.2.1-69057-13, respectively. The vendor does not list other families or branches in this advisory. The fixes correspond to nano updates that the release notes date to Oct 12, 2026 across several branches; on the official download server, the packages for all four builds were already listed between Sep 30 and Oct 2, 2026. Those who have already applied them may be protected; it is advisable to verify the exact build.

The vendor did not publish a temporary mitigation (listed as none) and reports no exploitation. No public proof of concept was identified. As of Nov 11, 2026, these vulnerabilities are not listed in catalogs of known exploited vulnerabilities. At the cutoff, the public records for these CVEs remain reserved, with no descriptive record; the canonical source is the vendor advisory. On the same day, Nov 10, 2026, advisory Synology-SA-26:18 fixes other vulnerabilities of lesser or different severity in DSM 7.4 and 7.3, with the same builds for those two branches; this advisory focuses on SA-26:19.

Mitigation

It is recommended to inventory Synology devices running DSM, record the branch and exact build, and update to the fixed version for the branch in use, or a later version. If the device does not offer the update on its own, apply it manually, as indicated in the vendor’s release notes: rollout may be staged, and the system may determine that notification is not required. The update restarts the device. Those who have already installed the October nano updates should confirm that the build is at least the one specified in the advisory.

The vendor did not publish an alternative solution. While updating, as a general measure —not an official procedure from the advisory—, avoid exposing the NAS to the Internet and restrict access to the DSM interface and rsync to trusted administrative networks. The patch does not undo a previous compromise. The vendor did not publish indicators of compromise.

Solution

The solution is to update Synology DiskStation Manager to the fixed build for the branch in use (7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10, or 7.2.1-69057-13, or later), on all affected devices.

For information on how to update, visit the following link:

https://www.synology.com/en-us/security/advisory/Synology_SA_26_19

Additional information: