Synology DSM CVE-2026-76954 (Auth API SQL Injection): How to Check Exposure and Fix It

On November 10, 2026, Synology published security advisory Synology-SA-26:19 for DSM (DiskStation Manager), the operating system of its NAS devices. It fixes two flaws at the same time: CVE-2026-76954, an SQL injection in the Auth API (CVSS 3.1 score 9.8, Critical), and CVE-2026-85101, an authentication bypass in rsync (CVSS 3.1 score 8.6). The fixes ship in DSM 7.4, 7.3, 7.2.2 and 7.2.1 updates. Synology lists the mitigation as "None," so updating is the only remedy.

This article is based on the Synology advisory (English and Japanese versions), the CVE.org records, NVD and CISA's KEV catalog as of November 13, 2026. Where something could not be confirmed we say "not confirmed" or "not disclosed" instead of guessing. Other vulnerabilities from the same day are covered in the November 13 vulnerability digest.

- What happened: The DSM Auth API contains an SQL injection (CVE-2026-76954) that lets remote attackers read or write arbitrary files and cause denial of service (DoS). The CVSS vector is AV:N/AC:L/PR:N/UI:N: network-reachable, no authentication, no user interaction. A separate rsync authentication bypass (CVE-2026-85101) lets remote attackers read specific files, write arbitrary files and cause limited DoS.
- Who is affected: DSM 7.4, 7.3, 7.2.2 and 7.2.1 builds older than the fixed versions: 7.4.1-90080-1 or later, 7.3.2-86009-5 or later, 7.2.2-72806-10 or later, 7.2.1-69057-13 or later.
- What to do today: (1) check the DSM version on each NAS, (2) update to a fixed version and reboot, and (3) until you can update, keep the NAS off the internet. Synology's advisory does not mention exploitation, and as of this check neither CVE is in CISA's KEV catalog.

The advisory gives the same version boundaries for both CVEs. If you run a build older than the "fixed version" in the table, you need to update.

The advisory names only DSM as the product. Whether BeeStation, DSM UC or other Synology products are affected is not stated in this advisory. If you use one of them, check Synology's security advisory list for guidance specific to that product.

When you log in to a NAS, DSM checks the user name and other details through an internal "Auth API," the component that handles authentication. Behind the scenes it builds database queries (SQL). If special characters in the input are not neutralized properly, an attacker can rewrite the query itself. This is SQL injection (CWE-89). Think of a front-desk clerk who carries out extra instructions written on a form.

Synology says this flaw lets remote attackers read or write arbitrary files and conduct DoS attacks. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: no authentication or user action is needed, and the impact on confidentiality, integrity and availability is high. Because a NAS gathers company files, arbitrary read and write access can lead to both data leaks and tampering.

rsync is a mechanism for efficiently synchronizing and copying files, used for NAS-to-NAS backups and for syncing from PCs. DSM includes an rsync service. CVE-2026-85101 is a flaw (CWE-288) where an alternate path or channel lets an attacker get around the authentication that should be required.

According to Synology, a remote attacker can read specific files, write arbitrary files and cause limited DoS. The CVSS 3.1 score is 8.6 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), again with no authentication needed. The low confidentiality impact appears to reflect that only "specific" files can be read, but which files is not disclosed.

The scores were assigned by Synology as the CNA. NVD recorded both CVEs on November 12, 2026, and its status is "Awaiting Analysis," so NVD has not yet added its own assessment.

On exploitation, the Synology advisory makes no mention of it. We searched CISA's KEV (Known Exploited Vulnerabilities) catalog data for CVE-2026-76954 and CVE-2026-85101 on November 13, 2026, and neither was listed. That is not proof that they are not exploited. Because the flaws are network-reachable without authentication, attackers may study the patch differences once fixes are public, so updating soon is advisable. The situation can change, so keep checking KEV and Synology's information.

In the management screen, open "Control Panel," then the "General" tab of "Info Center," and read the DSM version. It is important to read the build number after the hyphen and the Update number at the end, as in "DSM 7.3.2-86009 Update 4." The fixed versions in the advisory have a trailing number after the hyphen, such as "7.3.2-86009-5," which appears to correspond to the Update number. "7.3.2-86009 Update 4" would therefore be older than the fixed version (-5).

Menu names and display details may differ by DSM version and language. For this research we could not retrieve the body of the relevant official Synology knowledge-base pages, so the screen names here are based on the general DSM 7 layout. If your screen differs, use the search box in the management screen or ask the company that set up the NAS.

If SSH is enabled, the following command also shows the version. It is introduced as a common method in Synology community posts and has not been confirmed in Synology's official knowledge base. It prints the majorversion, minorversion, buildnumber and smallfixnumber values; smallfixnumber corresponds to the Update number.

- Whether the router forwards ports to the NAS management screen (5000 and 5001 by default) or to rsync (873 by default)
- Whether QuickConnect (Synology's relay service) is enabled
- Whether DDNS (a way to reach the NAS by name from outside) has been set up for remote file access
- Whether you actually use the rsync service. If you do not, there is no reason to leave it on

An update prevents future intrusions; it cannot undo what already happened. Because these flaws may allow arbitrary files to be read or written without authentication, review the following before and after updating. Synology has not published specific indicators of compromise (IOCs), so these are general points.

- Whether the logs in Log Center show logins you do not recognize or a sudden rise in errors
- Whether shared folders contain unfamiliar files, files with oddly recent modification times, or files whose extensions changed
- Whether load or reboots have increased for no clear reason
- Whether there is unusually heavy outbound traffic (if you have router or firewall logs)

First, the preparation common to all lines. Before updating, confirm that the important data on the NAS is also backed up somewhere else. The update involves a reboot during which files are unavailable, so do it in a low-usage time window and notify staff. Afterwards, check file sharing, scheduled backups and the packages you use.

The general flow is: in the DSM menu open "Control Panel," then "Update & Restore," and when a new version appears under "DSM Update," download and install it by following the prompts. If no update candidate appears, or it does not show up automatically, you can download the update file (extension .pat) for your model from Synology's Download Center and apply it with "Manual DSM Update" in "Update & Restore." Always get the .pat file from Synology's official site, for your own model.

Update to 7.4.1-90080-1 or later. Other 7.4 builds, including older 7.4.1 builds, are affected if they are older than the fixed version. After updating, confirm in Info Center that the version is 7.4.1-90080 Update 1 or later.

Update to 7.3.2-86009-5 or later. After updating, confirm in Info Center that the version is 7.3.2-86009 Update 5 or later.

The fixed versions are 7.2.2-72806-10 or later for 7.2.2 and 7.2.1-69057-13 or later for 7.2.1. Whether a 7.2 device can move up to 7.3 or 7.4 differs by model and is not stated in the advisory. Check which versions are offered for your model in the update screen or on Synology's Download Center. Whether a fixed version is provided for your specific model could not be confirmed in this article.

To avoid delays on serious vulnerabilities like this one, consider enabling automatic installation of important updates in the update settings under "Update & Restore." Automatic updates trigger a reboot, so confirm you can schedule them outside business hours. Even with automatic updates on, verify by version number that this fix was actually applied. For how to build an update routine, see Getting Started with Patch and Update Management.

Synology lists the mitigation as "None" for both CVEs. There is no official way to reliably close either flaw by changing settings alone. The following are not official mitigations but general exposure-reduction measures. Use them to buy time until you can update; they are not a substitute for updating.

- Take the NAS off the internet (general measure): remove router port forwarding and do not expose the management screen or rsync. If you use QuickConnect or DDNS, consider turning them off until the update is done.
- Restrict who can connect to the management screen (general measure): use DSM's firewall feature or the router or UTM settings to limit access to office addresses or VPN connections.
- Disable the rsync service if you do not use it (general measure): in "Control Panel," under "File Services," disable rsync if it is not needed. If backups use rsync, turning it off will make those jobs fail. Synology does not say whether this reliably closes CVE-2026-85101 or has any effect on CVE-2026-76954, so we could not confirm that.
- Turn off unneeded services such as SSH (general measure): reduce the entry points an attacker can use.
- Make backups reliable (general measure): because arbitrary files may be altered, keep a backup outside the NAS and confirm that the backup destination is not continuously writable from the NAS. Ransomware preparation is summarized in Ransomware Basics for Small Businesses.

If your company has not decided who owns NAS updates and operation, it may be worth revisiting device selection and operations design as well. For cost guidance, see NAS and File Server Costs and How to Choose.

1. List every Synology NAS in the company (model, location, owner).
2. Check and record the DSM version of each NAS in Info Center.
3. List the NAS devices older than the fixed versions (7.4.1-90080-1 / 7.3.2-86009-5 / 7.2.2-72806-10 / 7.2.1-69057-13 or later).
4. Before updating, confirm that important data is backed up elsewhere.
5. Set a date and time, notify staff, and update DSM (it involves a reboot).
6. After updating, check the version, file sharing and backup jobs.
7. Check whether the NAS is visible from the internet (port forwarding, QuickConnect, DDNS) and turn off what is not needed.
8. Disable unused services such as rsync and SSH.
9. Look for suspicious signs in shared folders and logs.
10. For versions older than 7.2.1 or models with no fixed version, check Synology's support information and plan a replacement.

- Synology-SA-26:19 (English): https://www.synology.com/en-global/security/advisory/Synology_SA_26_19
- Synology-SA-26:19 (Japanese): https://www.synology.com/ja-jp/security/advisory/Synology_SA_26_19
- CVE.org CVE-2026-76954 (CVE record): https://www.cve.org/CVERecord?id=CVE-2026-76954
- CVE.org CVE-2026-85101 (CVE record): https://www.cve.org/CVERecord?id=CVE-2026-85101
- NVD CVE-2026-76954: https://nvd.nist.gov/vuln/detail/CVE-2026-76954
- NVD CVE-2026-85101: https://nvd.nist.gov/vuln/detail/CVE-2026-85101
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Synology Community, "Finding DSM version via command line?": https://community.synology.com/enu/forum/17/post/72754