by Kastro
Paper/Archive/CVE-2026-76954

CVE-2026-76954

Synology DiskStation Manager (DSM) — An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM)…

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.9.509 × 2010.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Affected

ProductAffectedFixed inSource
DiskStation Manager (DSM)7.4.1 – < 7.4.1-90080-17.4.1-90080-1CNA
DiskStation Manager (DSM)7.3.2 – < 7.3.2-86009-57.3.2-86009-5CNA
DiskStation Manager (DSM)7.2.2 – < 7.2.2-72806-107.2.2-72806-10CNA
DiskStation Manager (DSM)7.2.1 – < 7.2.1-69057-137.2.1-69057-13CNA

Scores by source

synology (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsynology.com/en-global/security/advisory/Synology_SA_26_19