On 10 November 2026, Synology published a security advisory rated critical for DSM, the operating system of its network-attached storage (NAS) servers. The main flaw, CVE-2026-76954, scores 9.8 out of 10 and allows a remote attacker to read or write files on the device. There is no workaround: only the update provides protection. It adds to a series of alerts targeting Synology NAS devices since 22 October.
Two network flaws, one of them without authentication
The Synology-SA-26:19 advisory describes two vulnerabilities. The first, CVE-2026-76954, is an SQL injection in the DSM authentication interface, rated 9.8 on the CVSS 3.1 scale. Synology states that a remote attacker can use it to read or write arbitrary files and cause a denial of service. The published vector requires neither prior privileges nor any user action.
The second, CVE-2026-85101, rated 8.6, is an authentication bypass in the rsync service, the tool used to synchronise files between machines. According to Synology, it allows an attacker to read certain files, write arbitrary files and cause a limited denial of service.
The manufacturer credits two researchers from the Viettel Cyber Security lab, Nguyễn Bá Nam Dũng and Hà Thế Long, as well as Warisse Valentin. The advisory was updated on 13 November.
Twenty-five other flaws in a second advisory
Advisory SA-26:19 mentions only two flaws, but on the same day Synology published a second advisory, Synology-SA-26:18, rated important, which fixes twenty-five more: eight rated important and seventeen moderate. The most severe, CVE-2026-13672, rated 8.8, is an authorisation bypass in the SSOAuth single sign-on module, exploitable by a user who is already authenticated. This second advisory covers only DSM 7.4 and 7.3, with the same fixed versions. Daily Security Review thus puts the total at 27 vulnerabilities, one critical, nine high and seventeen medium, and notes that no exploitation and no public attack code were known at the time of publication.
The fixed versions listed in advisory SA-26:19, and reported by the outlet, are as follows:
- DSM 7.4: 7.4.1-90080-1 or later;
- DSM 7.3: 7.3.2-86009-5 or later;
- DSM 7.2: 7.2.2-72806-10 or 7.2.1-69057-13, or later.
Each maintained branch therefore receives its own fix, with no forced version jump. The advisory does not clearly state which DSM 7.2 version applies to which subset of devices: check the Synology download centre for the file suited to your model.
NAS devices under pressure since late October
This advisory follows, among others, two alerts in October. On 29 October, Synology published a statement urging customers to update DSM after detecting ransomware attacks against devices still running outdated versions. The attackers were exploiting a flaw that had in fact been fixed in December 2024, referenced Synology-SA-24:20. The manufacturer recommends enabling automatic updates.
A week earlier, on 22 October, Synology had published advisory Synology-SA-26:14, rated critical, for two PHP flaws rated 9.8, CVE-2026-109618 and CVE-2026-109619, which appear in the alert published by CERT-FR from 21 October. The PHP 7.4 to 8.4 packages, Synology Calendar and Mail Station received fixes, extended on 29 and 31 October to devices running DSM 6.2, 7.0 and 7.1; PHP 7.3, which has reached end of life, will not receive any. Synology considers the risk related to the PHP built into the system to be very low, saying it is not exposed to external attacks.
What these episodes have in common fits in one sentence: a NAS is a server in its own right, and must be updated as such. The ransomware attacks in October specifically targeted machines that had not received a fix available for almost two years.
Steps to take now
- Install the update for your DSM branch, from the control panel or the download centre.
- Take the administration interface off the internet: Daily Security Review stresses that devices whose management is accessible online face the highest risk, and recommends restricting the networks allowed to reach the NAS; according to the outlet, a device accessible only via VPN or placed behind a firewall faces a lower practical risk.
- Do not rely on the firewall alone: the outlet considers the update advisable even for protected devices, since the main flaw can be exploited remotely without credentials.
- Review your use of rsync and check the integrity of your backups, since the second flaw targets this service.
Frequently asked questions
Is my Synology NAS affected?
Yes, if it runs DSM 7.2, 7.3 or 7.4 in a version earlier than the fixed builds listed by Synology. The exact number can be found in the control panel, under the update section.
Is there a solution without updating?
No. The Synology advisory offers no mitigation. Restricting network access to the device reduces exposure in the meantime, but fixes nothing.
Is the flaw already being exploited?
No exploitation had been reported at the time of publication, according to Daily Security Review. The ransomware attacks reported in late October targeted another, older flaw.
Sources
- Synology-SA-26:19 DSM — Synology, 2026-11-10
- Synology Patches 27 DSM Flaws, Including CVSS 9.8 SQL Injection — Daily Security Review, 2026-11-11
- Synology exhorte les utilisateurs à mettre à jour DSM à la suite d'attaques par ransomware visant des versions obsolètes de DSM — Synology, 2026-10-29
- Synology-SA-26:18 DSM — Synology, 2026-11-10
- Synology-SA-26:14 PHP2Shell — Synology, 2026-10-22
- CERTFR-2026-ALE-014 — Multiples vulnérabilités dans PHP — CERT-FR, 2026-10-21