Synology DSM CVE-2026-76954 + 14 more

This digest covers updates published on November 10-11 that matter most to small and mid-sized businesses. The top item is Synology DSM CVE-2026-76954 (SQL injection in the Auth API, CVSS 3.1 score 9.8). It can be attacked over the network without authentication and may allow arbitrary file reads and writes. Fixed versions are DSM 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13 or later, and no workaround is listed. If a NAS is reachable from your internal network or the internet, update it first. Step-by-step guidance is in Synology DSM CVE-2026-76954: check and fix.

We also cover Chrome 157 stable (83 fixes, 5 Critical), the Node.js security release (16 fixes, 7 High) and an emergency hotfix for the N-able N-central management tool (CVE-2026-125883). In this article, "exploitation confirmed" means the CVE is in CISA's KEV catalog or the vendor itself has confirmed exploitation. None of today's items meet that bar. However, exploit code for N-central is public and scanning and attack attempts have been reported (details below). Items from earlier digests (Apache, Ivanti, Fortinet, SAP, Outlook, Exchange and others) are not repeated because nothing new has been published. Counts are per CVE, and only Critical and High items are listed.

Synology published advisory Synology-SA-26:19 on November 10 (Taiwan time). Overall severity is Critical and the status is "Resolved." The CVE records were published on November 12.

CVE-2026-76954 is an SQL command injection (CWE-89) in the Auth API of DiskStation Manager (DSM). Remote attackers may be able to read or write arbitrary files and cause denial of service. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N): network-reachable, no authentication, no user interaction.

CVE-2026-85101 is an authentication bypass (CWE-288) in rsync. Remote attackers may bypass authentication to read specific files, write arbitrary files and cause limited denial of service. Severity is Important and the CVSS 3.1 score is 8.6.

Affected are the DSM 7.4, 7.3, 7.2.2 and 7.2.1 branches before the following fixes: 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13 or later. The workaround field in the advisory says "None," so updating is the only remedy. The advisory does not mention exploitation. Credited finders are two researchers from Viettel Cyber Security Research Lab and one from Aytio.

To check, open Control Panel > Info Center in DSM to see the version, or Control Panel > Update & Restore to see whether an update is available. Back up first, then apply the update. Also review any setup that exposes the management page (ports 5000/5001 by default) or file sharing to the internet. For NAS selection and running costs, see NAS and file server costs for SMBs (Japanese). Source: Synology-SA-26:19.

N-central is a management tool that IT service providers use to administer customers' PCs and servers. On November 10, N-able released an emergency hotfix, N-central 2026.4 HF2 (build 2026.4.1.26). The release notes list seven CVEs, and CVE-2026-125883 is an XML external entity (XXE, CWE-611) flaw. According to the CVE record, the CVSS 4.0 score registered by N-able itself is 9.3 (Critical, AV:N/AC:L/PR:N/UI:N), and versions before 26.4.1 are affected.

We separate exploitation claims by source. The CISA ADP field in the CVE record (dated November 11) lists Exploitation as "poc," meaning exploit code exists; it is not a confirmation of attacks. CISA's KEV catalog does not list it in the data we could check (updated after 19:00 UTC on November 10). CSO Online (November 10) reports that a researcher published exploit code on November 8, that N-able has seen related scanning but no evidence of a successful compromise in customer environments, and that security firm Previdian recorded 68 attack attempts from one IP on a honeypot. That is press reporting; N-able's own pages do not mention exploitation.

The fix is to update on-premises N-central servers to 2026.4.1.26. According to N-able's release notes, both hosted and on-premises customers must upgrade Agents and Probes; N-able does not upgrade them even for hosted servers. Upgrade Agents before Probes. The other six fixes in the hotfix include OGNL injection (CVE-2026-125878) and RCE via a file repository upload path (CVE-2026-125882). If you do not know whether you use N-central, ask your IT service provider. Sources: N-central 2026.4 HF2 release notes, N-able advisory, CVE record, CSO Online.

Chrome Releases announced on November 11 that the stable channel was updated to 157.0.8103.78/.79 (Windows and Mac) and 157.0.8103.78 (Linux), rolling out over the coming days and weeks. It includes 83 security fixes, 5 of them Critical, all use-after-free: ServiceWorker (CVE-2026-126885), CSS (CVE-2026-126895), Layout (CVE-2026-126879), Skia (CVE-2026-126846) and Accessibility (CVE-2026-126911). Most of the rest are High, including V8, Skia and ANGLE. The post does not mention exploitation.

This is separate from the recently exploited CVE-2026-125350. Browser updates are easy and effective, so apply them early. To check, open the Chrome menu, choose Help > About Google Chrome, confirm the version is 157.0.8103.78 or later, and click Relaunch if prompted. Source: Chrome Releases (November 11, 2026). For the earlier case, see Chrome CVE-2026-125350: check and fix (Japanese).

Node.js published security releases on November 11 for the 22.x, 24.x and 26.x lines. Fixed versions are v22.23.5, v24.22.3 and v26.13.1. The 16 fixes break down into 7 High, 6 Medium and 3 Low, and the highest severity in each line is High. The dependencies llhttp (all lines), undici (24.x and 26.x) and sqlite (22.x and 24.x) were also updated. The official page does not mention exploitation.

The seven High issues mostly concern HTTP/2 and TLS.

- CVE-2026-123863 (24.x, 26.x): an assertion during HTTP/2 session teardown lets an unauthenticated remote client abort the process
- CVE-2026-123864 (22.x, 24.x, 26.x): a zero-length TLS write over HTTPS re-enters llhttp, causing use-after-free and heap disclosure in request bodies. Cleartext node:http is not affected
- CVE-2026-123865 (all lines): HTTP/2 sessions leak memory and file descriptors on a protocol error during shutdown; an incomplete earlier fix
- CVE-2026-123866 (all lines): tearing down an HTTP/2 stream during a backpressured write sends freed response memory to the peer
- CVE-2026-126051 (24.x, 26.x): a deferred TLS handshake callback uses a destroyed socket, and the uncaught exception crashes the server
- CVE-2026-123872 (all lines): TLS 1.2 renegotiation lets a client change the servername and bypass client-certificate policy on another host
- CVE-2026-123874 (24.x, 26.x): resetting a respondWithFile() stream during a pending write causes an HTTP/2 stream use-after-free

You are affected if you run HTTP/2 or HTTPS servers on Node.js yourself. If Node.js is only a build tool on developer PCs, the risk is limited. Check with node -v and compare with the fixed version for your line (22.23.5, 24.22.3, 26.13.1). Also check whether Docker images or CI base images are pinned to old versions. Source: Node.js November 2026 Security Releases.

Node.js also fixed 6 Medium and 3 Low issues; the full list is on the official page above.

- Find out whether your company has a NAS (such as Synology) and ask the administrator to check the DSM version
- If DSM is older than the fixed versions (7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10, 7.2.1-69057-13), back up and update
- Check that the NAS management page and file sharing are not directly reachable from the internet
- Ask your IT service provider whether it uses N-able N-central, and if so, confirm 2026.4 HF2 and the Agent and Probe updates
- Restart Chrome on company PCs and confirm the version is 157.0.8103.78 or later
- Ask your developers or vendors whether any Node.js servers are in use, and if so, when they will move to the fixed versions
- Record products you do not use as "checked, no action needed"

- Synology DSM CVE-2026-76954 (SQL injection): check and fix
- NAS and file server costs for SMBs
- Chrome CVE-2026-125350: check and fix
- Previous digest (Apache and more)
- Patch and update management guide for SMBs

- Synology-SA-26:19: https://www.synology.com/en-global/security/advisory/Synology_SA_26_19
- CVE-2026-125883 record: https://www.cve.org/CVERecord?id=CVE-2026-125883
- N-central 2026.4 HF2 release notes: https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/
- N-able advisory: https://me.n-able.com/s/security-advisory/aArVy0000002ihhKAA/cve2026125883-multiple-xxe-vulnerabilities
- CSO Online (N-central reporting): https://www.csoonline.com/article/4247028/n-able-n-central-gets-emergency-fix-two-days-after-33-exploits-published.html
- Chrome Releases (November 11, 2026): https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html
- Node.js November 2026 Security Releases: https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog