An explainer on an unauthenticated SQL injection in the Synology DSM Auth API. It covers what happens, who is affected and how to respond, from a defender's point of view and without attack steps.
- CVE
- CVE-2026-76954 (SQL injection in the Synology DSM Auth API). Advisory Synology-SA-26:19
- Severity
- CVSS v3.1 9.8 (Critical; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; assigned by Synology)
- Type
- Improper neutralization of special elements in an SQL command (CWE-89). No authentication required
- Impact
- Remote attackers could read or write arbitrary files and conduct denial of service (Synology's description)
- Affected
- DSM 7.4 (before 7.4.1-90080-1), 7.3 (before 7.3.2-86009-5), 7.2.2 (before 7.2.2-72806-10), 7.2.1 (before 7.2.1-69057-13)
- Fix
- 7.4.1-90080-1 / 7.3.2-86009-5 / 7.2.2-72806-10 / 7.2.1-69057-13 (or above)
- Published
- Advisory on 10 November 2026; CVE.org record on 12 November
- Workaround
- Synology's advisory: "None"
- Exploitation
- None reported. Not in the 10 November edition of CISA KEV
A NAS is both where the data lives and a target
A NAS gathers shared files and backups. A flaw that allows file reads and writes without authentication can lead to data leaks, tampering or encryption. For ransomware aimed at Synology devices, see ransomware attacks on Synology DSM.
What kind of vulnerability is it
Synology's advisory says the DSM Auth API has improper neutralization of special elements used in an SQL command (CWE-89), and that remote attackers could read or write arbitrary files and cause denial of service. As the CVSS vector shows, neither authentication (PR:N) nor user interaction (UI:N) is needed. For the background, see what is SQL injection.
- It assumes the device is reachable over the network (AV:N). The risk rises when the management interface can be reached from the internet or an untrusted network.
- The advisory does not describe how to exploit it or which requests are dangerous, and this site does not either.
- It was found by an external researcher's report.
Affected scope
| Item | Detail |
|---|---|
| Product | Synology DiskStation Manager (DSM) |
| DSM 7.4 | Update to 7.4.1-90080-1 or above |
| DSM 7.3 | Update to 7.3.2-86009-5 or above |
| DSM 7.2.2 | Update to 7.2.2-72806-10 or above |
| DSM 7.2.1 | Update to 7.2.1-69057-13 or above |
| Workarounds / mitigations | None (Synology's advisory) |
- The advisory lists only these four lines. It says nothing about lines older than DSM 7.2.1 (7.1, 6.x and so on), and the CVE.org record marks them "unknown". If you run an older DSM, ask Synology, check its support status, and consider updating or replacing the device.
- The advisory lists no products other than DSM (SRM, for example).
The other issue in the same advisory: CVE-2026-85101
| Item | Detail |
|---|---|
| What | Authentication bypass using an alternate path or channel in DSM's rsync (CWE-288) |
| Severity | CVSS v3.1 8.6 (High). No authentication required |
| Impact | Reading specific files, writing arbitrary files, limited denial of service (Synology's description) |
| Affected / fixed | Same versions and fixed releases as CVE-2026-76954 |
One update fixes both. If you back up to the NAS over rsync, check that the connection still works after updating.
How to check whether you are affected
Check the DSM version
Log in to DSM and open Control Panel, then Info Center, then General to see the DSM version. DSM 7.4 below 7.4.1-90080-1, 7.3 below 7.3.2-86009-5, 7.2.2 below 7.2.2-72806-10 or 7.2.1 below 7.2.1-69057-13 is affected.
Check whether the NAS is reachable from outside
Check your router's port forwarding and any remote-access features you use. If the DSM login page opens from outside, that is attack surface. If the NAS is reachable only from the internal network, the risk is lower accordingly.
Count your NAS devices
Check whether any departments or sites run a NAS that the administrators do not know about. For how to keep a list, see the asset inventory checklist.
What to do today
Check backups, then update DSM (top priority)
Before updating, confirm that backups of important data exist and can be restored (backup essentials). Then go to Control Panel, then Update & Restore, and update to the fixed release for your line or later. The update may reboot the device, so tell users and pick a time.
Do not expose the management interface directly to the internet
Synology's advisory has no workaround, so this is a general defence added by this site. If DSM's management interface is published through router port forwarding, stop it, and if you need access from outside, route it through a VPN. For a NAS you cannot update, make sure above all that it is unreachable from outside.
Restrict the source addresses
Use the NAS firewall to limit who can connect to the management interface to the internal network or the devices that need it.
Check for anything unusual after updating
No exploitation is reported, but check that nothing odd happened before the update. Look for accounts or shared folders you do not recognise, configuration changes and sign-in history. If anything looks wrong, consider changing passwords and restoring from backup.
Plan for devices that are out of support
For a NAS on an old DSM that will not receive a fix, make it unreachable from outside and plan its replacement.
Exploitation status
- Synology's advisory does not mention exploitation.
- It is not in the 10 November edition of CISA's KEV catalog.
- The advisory's status is "Resolved", and the only revision is the initial release (10 November 2026).
- No public information on the scale, techniques or actors of any attacks could be confirmed.
- No reported exploitation does not mean none exists. With a high, unauthenticated rating (9.8), prioritise the update.
Sources
- Synology — Synology-SA-26:19 DSM (published 10 November 2026; two CVEs, affected and fixed versions, no mitigation)
- CVE.org — CVE-2026-76954 (recorded 12 November 2026; CWE-89, CVSS 9.8)
- CVE.org — CVE-2026-85101 (rsync authentication bypass; CWE-288, CVSS 8.6)
- CISA KEV — Known Exploited Vulnerabilities Catalog (not listed in the 10 November edition of the catalog)
Keeping the management interface off the internet and routing access through a VPN are listed here by this site as general defences; they are not workarounds stated in Synology's advisory. Last verified: 13 November 2026.
Read next
- NAS: Ransomware attacks on Synology DSM
- Practice: The vulnerability remediation playbook / Asset inventory checklist
- Preparation: Backup essentials
- Deciding: Prioritising with CVSS, EPSS and KEV
- Terms: What is SQL injection / What is CVSS?