Synology has released an important security update for its DiskStation Manager (DSM) software. The advisory, published on November 10, 2026, addresses two security vulnerabilities: CVE-2026-76954 and CVE-2026-85101.
The most serious issue is Synology DSM CVE-2026-76954, a critical SQL injection vulnerability in the DSM Auth API. It has a CVSS score of 9.8 out of 10, making it a high-priority issue for NAS owners and IT teams.
According to Synology, attackers could exploit this flaw remotely without needing user interaction or existing privileges. The reported impact includes reading or writing arbitrary files and causing denial-of-service attacks.
Understanding the Two Synology DSM Vulnerabilities
Synology’s security advisory, Synology-SA-26:19, covers two separate vulnerabilities. Both are fixed through the same DSM updates.
| Vulnerability | Affected component | Severity | CVSS Score |
|---|---|---|---|
| CVE-2026-76954 | DSM Auth API | Critical | 9.8 |
| CVE-2026-85101 | DSM rsync | Important | 8.6 |
The second vulnerability, CVE-2026-85101, involves an authentication bypass in rsync. It could allow remote attackers to access specific files, write arbitrary files and cause limited denial-of-service attacks.
Both issues should be addressed by installing the correct security update.
Which Synology DSM Versions Are Affected?
Synology lists DSM 7.4, 7.3, 7.2.2 and 7.2.1 as affected software branches.
Users should upgrade to the following fixed builds or later versions within their respective branches:
| DSM Version | Fixed Build |
|---|---|
| DSM 7.4 | 7.4.1-90080-1 |
| DSM 7.3 | 7.3.2-86009-5 |
| DSM 7.2.2 | 7.2.2-72806-10 |
| DSM 7.2.1 | 7.2.1-69057-13 |
If your NAS is already running the listed build or a later build in the same branch, it is outside the affected version range published by Synology.
How to Protect Your Synology NAS
Synology has not provided a separate workaround for these vulnerabilities. Its recommended solution is to install the fixed DSM release.
If you manage a Synology NAS, follow these steps:
- Check your current DSM version and build number.
- Open the DSM update section.
- Install the fixed update for your software branch.
- Confirm that the installation was successful.
- Review whether DSM management, the Auth API and rsync are accessible from the internet.
Until the update is installed, restricting access to these services through a VPN or internal network can reduce exposure. However, this is additional security guidance, not a replacement for patching.
Is There Evidence of Active Exploitation?
Synology’s advisory does not confirm active exploitation of either vulnerability. Neither CVE was listed in CISA’s Known Exploited Vulnerabilities catalog in the November 12, 2026 check described in the advisory research.
This does not mean the vulnerabilities are harmless. NAS devices often store backups, business documents and shared files, so an exposed and unpatched device can create serious security risks.
Final Thoughts
The Synology DSM CVE-2026-76954 vulnerability deserves immediate attention because of its critical 9.8 severity score and potential remote impact. The second flaw in rsync adds another reason to update without delay.
Businesses should also ask their suppliers and managed service providers whether they use Synology DSM and whether their devices are running fixed builds. Updating systems and checking external access are important steps toward protecting valuable data.
