Synology patches critical SQL injection in the DSM login API

Synology patches critical SQL injection in the DSM login API

10 November 2026: Synology has fixed CVE-2026-76954, a critical SQL injection (CVSS 9.8) in the Auth API of DiskStation Manager that lets a remote attacker with no login read or write arbitrary files and knock the device over. Its advisory SA-26:19 offers no workaround and does not report exploitation.

Fixed releases for each DSM line

The same advisory covers CVE-2026-85101 (CVSS 8.6), an authentication bypass in rsync that allows a remote attacker to read specific files, write arbitrary files and cause limited denial of service. Both are closed by these builds:

• DSM 7.4: 7.4.1-90080-1 or above
• DSM 7.3: 7.3.2-86009-5 or above
• DSM 7.2.2: 7.2.2-72806-10 or above
• DSM 7.2.1: 7.2.1-69057-13 or above

Synology credits Nguyễn Bá Nam Dũng and Hà Thế Long of Viettel Cyber Security Research Lab, and Warisse Valentin of Aytio.

Twenty-five further flaws that stop at DSM 7.3

Advisory SA-26:18, published in the same minute, lists 25 further CVEs rated Important or Moderate. The fixes are named only for DSM 7.4 (7.4.1-90080-1) and DSM 7.3 (7.3.2-86009-5).

Several are serious for a device holding shared company files. CVE-2026-13672 is an authorization bypass in SSOAuth, CVE-2026-18792 a path traversal in the Sharing API and CVE-2026-74857 a missing authentication step in the Auth API, each scoring 8.8 and each giving any logged-in user read or write access to arbitrary files. CVE-2026-18596, an 8.1 in the one-time password code, lets an attacker holding valid credentials do the same, which undercuts a second factor as a defence. CVE-2026-81584 is an SQL injection in the User API that needs control of a compromised LDAP or Active Directory server.

A company on DSM 7.2.x should read the two advisories together. The critical pair have fixes on that line, while the SA-26:18 table does not list 7.2 at all, and the page does not say whether those builds are unaffected or simply unpatched. Moving to 7.3 or later, where the hardware allows it, settles the question.

Plex package and earlier warnings

Separately, SA-26:17 of 8 November updates the Plex Media Server package for the flaws Synology labels Plex2Shell, including CVE-2026-96656 (CVSS 7.2), in which an admin user can write files that run when the server next loads them. Fixed builds are 1.43.5.11079-720011079 on DSM 7.4 and 7.3 and 1.43.5.11079-700011079 on 7.2.2 and 7.2.1.

Italy's national cybersecurity agency issued its own alert on the DSM fixes the same day. We have reported on Synology's warning about ransomware hitting DSM left unpatched and on its PHP2Shell advisory.

Exposure matters more than usual here because the critical bug needs no account. A NAS reachable from the internet should be updated first, and until then taken off the public address.

Related on TrustList:

• QNAP warns of hacked NAS boxes via Plex: updating will not clean them
• Synology adds PHP2Shell fixes for older DSM, but not for PHP 7.3
• Broadcom fixes 61 Brocade Fabric OS, SANnav and ASCG flaws

Sources

• Synology-SA-26:19 DSM, 10 November 2026
• Synology-SA-26:18 DSM, 10 November 2026
• Synology-SA-26:17 Plex Media Server, 8 November 2026
• Agenzia per la Cybersicurezza Nazionale (Italy), alert on Synology DSM, 10 November 2026