Critical CVSS 9.8 Security news
Synology DSM fixes a critical Auth API SQL injection and an rsync authentication bypass
Synology published advisory Synology-SA-26:19 on 10 November 2026 with a DSM update for its NAS devices. The most severe flaw, CVE-2026-76954 (CVSS 9.8), is an SQL injection in the Auth API that lets an unauthenticated attacker read and write arbitrary files. A second flaw, CVE-2026-85101 (CVSS 8.6), bypasses authentication in rsync. DSM 7.2.1 through 7.4 are affected. There are no reports of exploitation so far, but Synology NAS devices are a frequent ransomware target. Here is which build to install and how to confirm your device is patched.
Key points
- Affects: owners and admins of Synology NAS devices running DSM 7.4, 7.3, 7.2.2 or 7.2.1 without the 10 November 2026 update.
- CVE-2026-76954 (CVSS 9.8, critical) – SQL injection (CWE-89) in the Auth API. A remote, unauthenticated attacker can read and write arbitrary files and cause a denial of service.
- CVE-2026-85101 (CVSS 8.6, important) – authentication bypass using an alternate path or channel (CWE-288) in rsync. An attacker can read specific files, write arbitrary files and cause limited denial of service.
- Fixed builds: 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13. Synology lists no workaround and has published no indicators of compromise. The flaws were reported by Viettel Cyber Security researchers and Warisse Valentin.
Vulnerabilities: CVE-2026-76954, CVE-2026-85101
What happened
On 10 November 2026 Synology published security advisory Synology-SA-26:19 for DSM (DiskStation Manager), the operating system of its NAS devices. Synology rates the advisory critical and says the update fixes multiple vulnerabilities, two of which it details:
- CVE-2026-76954 – SQL injection in the Auth API, CVSS 3.1 9.8 (critical),
- CVE-2026-85101 – authentication bypass in rsync, CVSS 3.1 8.6 (important).
Both CVEs appeared in NVD on 12 November 2026, still in "Received" status with Synology's scores. They were reported by Nguyễn Bá Nam Dũng and Hà Thế Long of Viettel Cyber Security Research Lab and by Warisse Valentin (Aytio). Synology does not mention exploitation, and neither flaw is in the CISA KEV catalog.
Technical details
CVE-2026-76954 is an SQL injection (CWE-89) in the Auth API, the interface DSM uses to handle logins. The API fails to neutralise special characters, so an attacker can smuggle their own commands into a database query. According to Synology, a remote attacker can read or write arbitrary files and cause a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) means network access to the interface is enough, the attack is low-complexity, and it needs no authentication and no user interaction.
CVE-2026-85101 is an authentication bypass using an alternate path or channel (CWE-288) in the rsync component DSM uses for synchronisation and backups. An unauthenticated attacker can read specific files, write arbitrary files and cause limited disruption (vector C:L/I:H/A:L).
From a defender's point of view, arbitrary file writes on a NAS are serious: they can lead to tampered configuration, planted malicious code or destroyed data. Synology has not released further technical details or proof-of-concept code.
| CVE | CVSS 3.1 | Component | Weakness | Impact |
|---|---|---|---|---|
| CVE-2026-76954 | 9.8 | Auth API | SQL injection (CWE-89) | arbitrary file read and write, DoS |
| CVE-2026-85101 | 8.6 | rsync | authentication bypass (CWE-288) | read specific files, write arbitrary files, limited DoS |
Who is affected
Both flaws affect these DSM branches before the listed fix:
| DSM branch | Fixed build |
|---|---|
| DSM 7.4 | 7.4.1-90080-1 or later |
| DSM 7.3 | 7.3.2-86009-5 or later |
| DSM 7.2.2 | 7.2.2-72806-10 or later |
| DSM 7.2.1 | 7.2.1-69057-13 or later |
You can find your version in DSM under Control Panel → Info Center (or Update & Restore). Older branches (DSM 7.1, 7.0, 6.2) are not listed in the advisory and Synology has not released a fix for them.
The devices most at risk are those whose DSM web interface is reachable from the internet (forwarded port 5000/5001 or a custom domain) and those with the rsync service exposed externally. That is our inference from the flaw descriptions; Synology does not specify risky configurations.
How to tell if you were compromised
Synology has not published indicators of compromise. A few tips from our own practice:
- In Log Center, look for unusual login attempts and authentication errors from unfamiliar IP addresses, especially from 10–12 November 2026 onwards.
- Check for unknown user accounts, scheduled tasks (Control Panel → Task Scheduler), packages or startup scripts.
- Watch for suddenly modified or renamed files in shared folders – a typical first sign of ransomware.
- Pull IP addresses and domains out of exported logs with our IOC extractor – it runs entirely in your browser.
What to do
- Update DSM under Control Panel → Update & Restore to the build in the table above or later. After the reboot, confirm the version number.
- Enable automatic installation of important updates in the same place so you do not miss the next fix.
- Keep the NAS admin interface off the internet. Use a VPN for remote access. If DSM must be reachable from outside, restrict access to known addresses with the DSM firewall.
- Disable the rsync service if you do not need it (Control Panel → File Services → rsync). If it serves as a backup target, allow it only from the source devices' addresses.
- Keep a backup off the NAS – offline or immutable. An update will not bring back data an attacker has already destroyed or encrypted. See also our article on ransomware hitting Synology NAS devices on outdated DSM.
- If you suspect a compromise, disconnect the device from the network, preserve the logs and report the incident to your national CERT (in the US, CISA; in the UK, the NCSC).
Timeline
Updates
- 12 November 2026 – first version of this article.
FAQ
Is it being exploited?
Synology does not mention exploitation and neither flaw is in the CISA KEV catalog (as of 12 November 2026). However, attackers have recently been hitting outdated Synology NAS devices with ransomware, and a pre-authentication bug in the login API is an attractive target. Do not delay the update.
My NAS is only on my home network. Do I still need to update?
Yes. The risk is highest for devices whose admin interface is reachable from the internet, but an attacker can also reach your home network through another compromised device. Updating is the only remedy Synology lists.
I run DSM 7.1 or older. Am I affected?
The advisory only lists DSM 7.2.1, 7.2.2, 7.3 and 7.4. Synology does not say whether older releases are vulnerable, and it has not shipped a fix for them. If your device supports a newer DSM, upgrade; if not, keep it off the internet and plan a replacement.
I only use rsync for backups between two NAS devices. Should I turn it off?
Update first. If you do not need the rsync service, disable it under Control Panel → File Services → rsync. If you need it as a backup target, do not expose it to the internet and allow it only from the source device's address in the DSM firewall. This is our recommendation, not Synology's guidance.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
Arara Message breach: 81 million email addresses stolen and phishing sent in card issuers' names
An attacker broke into Arara Message, a Japanese bulk email delivery service, took more than 81 million email addresses belonging to the customers of roughly 380 companies, and used the service itself to send up to 7.13 million phishing emails posing as credit card companies. The fallout is now reaching downstream customers: on 13 November 2026 the City of Osaka disclosed that 1.08 million addresses of users of its online services system were exposed. Here is what is confirmed and what it means for defenders and users.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
Exploited UnrealIRCd flaw CVE-2026-114713 lets any user run commands with server authority
On Friday 13 November 2026 CISA added CVE-2026-114713, a flaw in the UnrealIRCd IRC server, to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to fix it. The bug in the labeled-response module lets any user on a network with two or more linked servers inject server-to-server commands that are executed with server authority, such as KILL or GLINE. The project's maintainer called it the most critical UnrealIRCd issue in 15 years. The fix shipped on 7 November as version 6.2.7.1 and as a hot-patch that needs no restart.