CriticalCVSS9.82026-11-13
CVE-2026-76954 — SQL injection in the Synology DSM Auth API (unauthenticated, CVSS 9.8; fixed in 7.2.1-69057-13 and others): explainer and fix
Improper neutralization of special elements in an SQL command (CWE-89) in the Auth API of Synology DiskStation Manager (DSM). Synology's advisory SA-26:19 says remote attackers could read or write arbitrary files and cause denial of service; CVSS is 9.8 and no authentication is needed. Fixed releases exist for DSM 7.4, 7.3, 7.2.2 and 7.2.1, the advisory lists no mitigation, and no exploitation is reported. The same advisory's rsync authentication bypass (CVE-2026-85101, 8.6) is fixed in the same releases. This site's view: if a NAS is directly exposed to the internet, update DSM first and rethink the exposure itself.