CVE-2026-76954 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-85101 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.
Affected Products Product Severity Fixed Release Availability DSM 7.4 Critical Upgrade to 7.4.1-90080-1 or above. DSM 7.3 Critical Upgrade to 7.3.2-86009-5 or above. DSM 7.2.2 Critical Upgrade to 7.2.2-72806-10 or above. DSM 7.2.1 Critical Upgrade to 7.2.1-69057-13 or above.
CVE-2026-76954 Severity: Critical CVSS3 Base Score: 9.8 CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-89: Improper Neutralization of Special Elements used in an SQL Command An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVSS3 Base Score: 9.8
CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-85101 Severity: Important CVSS3 Base Score: 8.6 CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CWE-288: Authentication Bypass Using an Alternate Path or Channel An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.
CVSS3 Base Score: 8.6
CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CWE-288: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.
Nguyễn Bá Nam Dũng (@greengrass19000) and Hà Thế Long (LongHT) from Viettel Cyber Security Research Lab (@vcslab)
Nguyễn Bá Nam Dũng (@greengrass19000) and Hà Thế Long (LongHT) from Viettel Cyber Security Research Lab (@vcslab)
Warisse Valentin (Aytio)
Warisse Valentin (Aytio)
Revision Revision Date Description 1 2026-11-10 Initial public release.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
