Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-76954 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Synology |
| Product | DiskStation Manager (DSM) |
| Vulnerability Type | SQL injection (CWE-89) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
The NVD CVSS vector (AV:N/PR:N/UI:N) means a network-based attack with no authentication and no user interaction. Synology covers the issue in advisory Synology-SA-26:19, rated “Critical” with status “Resolved”.
Required Actions
- Update DSM to 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5 or 7.4.1-90080-1 (or later, depending on your branch) as per advisory Synology-SA-26:19.
- Do not expose the DSM interface to the internet; restrict administrative access to the management network or VPN.
- Review DSM logs for failed or unusual login attempts and unexpected changes to system files.
Who Is Affected?
The vulnerability affects Synology DiskStation Manager (DSM) versions earlier than 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5 and 7.4.1-90080-1. DSM is the operating system of Synology NAS devices, widely used by businesses for file storage and backups.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-76954 vulnerability?
CVE-2026-76954 is an SQL injection flaw (CWE-89) in the Auth API of Synology DiskStation Manager (DSM) that lets a remote attacker read and write arbitrary files and conduct denial-of-service attacks. CVSS score: 9.8.
Does exploiting CVE-2026-76954 require authentication?
No. According to the NVD CVSS vector, the attack is network-based and requires no authentication or user interaction.
How to protect against CVE-2026-76954?
Update DSM to 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5 or 7.4.1-90080-1 (or later, depending on the branch) as per advisory Synology-SA-26:19, and do not expose the DSM interface to the internet.
Who is affected by CVE-2026-76954?
Organizations running Synology NAS devices with DSM versions earlier than 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5 and 7.4.1-90080-1.
