Synology patches a 9.8 DSM flaw that can read and write files

Synology has released fixes for two DiskStation Manager flaws, including a critical SQL injection scored 9.8 that needs no login. The advisory, Synology-SA-26:19, was published on November 10. Synology marks the update resolved and does not say either flaw is being exploited.

CVE-2026-76954 is scored 9.8 by Synology. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is an SQL injection in the Auth API, in DSM versions before the fixed releases. Synology says a remote attacker can read or write arbitrary files and cause a denial of service. No login and no user action are required.

CVE-2026-85101 is scored 8.6 and rated important. Synology's vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. It is an authentication bypass in rsync. Synology says a remote attacker can read specific files, write arbitrary files, and cause a limited denial of service. That flaw also needs no login.

The fixes are tied to four DSM lines. DSM 7.4 should be updated to 7.4.1-90080-1 or above. DSM 7.3 should be updated to 7.3.2-86009-5 or above. DSM 7.2.2 should be updated to 7.2.2-72806-10 or above. DSM 7.2.1 should be updated to 7.2.1-69057-13 or above. Synology says the flaws affect DSM before those builds. It does not name a hardware model.

Synology lists no workaround. The mitigation field says none. The company credits researchers at Viettel Cyber Security Research Lab and Warisse Valentin. The overall severity of the advisory is critical because of the 9.8 flaw. The revision log calls the November 10 post the initial public release.