Synology Patches 27 Flaws in DiskStation Manager Including Critical Pre-Auth SQL Injection

TL;DR

Synology released urgent updates for Synology DiskStation Manager (DSM) to fix 27 security bugs across two reports. Led by a critical SQL injection flaw (CVE-2026-76954, CVSS 9.8), the bugs let remote attackers read or write files and crash NAS hosts. Because no workarounds exist, admins must install the latest DSM builds right away.

Notable CVEs

Why It Matters

Synology DiskStation Manager runs network storage hosts that hold backups and private files for firms and homes worldwide. Both the Synology-SA-26:19 advisory and the Synology-SA-26:18 bulletin confirm the high risk of these 27 bugs. In addition, Viettel Cyber Security researchers listed CVE-2026-76954 as a pre-auth zero-click remote code execution flaw.

Currently, neither source confirms any active attacks in the wild or public exploit code for these 27 flaws. While exact version counts remain private, over ten million Synology NAS systems run globally.

How the Attack Works

Critical Auth API and rsync Bugs

First, the SA-26:19 advisory covers two unauthenticated network flaws. Specifically, CVE-2026-76954 (CVSS 9.8) is an SQL injection bug (CWE-89) in the Auth API. As the vendor warns, “CVE-2026-76954 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.” Meanwhile, CVE-2026-85101 (CVSS 8.6) is a login bypass (CWE-288) in rsync. The report notes that “CVE-2026-85101 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.”

SSO, OTP, and API Flaws in DSM

Second, the SA-26:18 advisory lists 25 Important and Moderate bugs across internal DSM tools. Three flaws score 8.8 CVSS, hitting SSOAuth (CVE-2026-13672), the Sharing API (CVE-2026-18792), and the Auth API (CVE-2026-74857). All three let logged-in users read or write arbitrary files and crash services.

Furthermore, three bugs score 8.1 CVSS. These include an OTP login bypass (CVE-2026-18596), a symlink bug in thumb (CVE-2026-19048), and an SQL injection flaw in the User API via rogue LDAP servers (CVE-2026-81584). Other bugs include a pointer crash in nfsd (CVE-2026-18633, CVSS 7.5), command injection in the VPN API (CVE-2026-75785, CVSS 7.2), and missing login checks in WebDAV (CVE-2026-15198, CVSS 6.5).

Affected Versions

The two bugs in SA-26:19 hit Synology DiskStation Manager branches 7.4, 7.3, 7.2.2, and 7.2.1. Meanwhile, the 25 bugs in SA-26:18 affect DSM 7.4 and 7.3.

Patch and Mitigation Steps

Synology states that no workarounds exist for either report. Therefore, admins must update Synology DiskStation Manager to 7.4.1-90080-1 for DSM 7.4 or 7.3.2-86009-5 for DSM 7.3. Teams on older branches must update to 7.2.2-72806-10 for DSM 7.2.2 or 7.2.1-69057-13 for DSM 7.2.1.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.