Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11153 | Publication Date: 15 November 2026

Unauthenticated SQL Injection in Synology DSM Auth API
CVE-2026-76954

Summary

A critical SQL injection vulnerability has been identified in the Auth API of Synology DiskStation Manager (DSM). Tracked as CVE-2026-76954, the flaw allows a remote, unauthenticated attacker to read or write arbitrary files on the device and to conduct denial-of-service attacks.

The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical) by Synology (vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No authentication or user interaction is required. Fixed DSM builds were released under Synology security advisory SA-26:19.

Technical Overview

The Auth API in Synology DSM fails to properly neutralize special elements used in SQL commands (CWE-89). An attacker who can reach the Auth API over the network can inject malicious SQL, leading to the ability to read or write arbitrary files on the system and to disrupt service availability.

Because the attack requires no prior privileges and no user interaction, any DSM instance whose management or authentication-related interfaces are reachable from an untrusted network is at high risk. This includes devices exposed directly to the internet as well as those accessible from less-trusted internal segments.

Affected Systems

• DSM 7.4.1 before 7.4.1-90080-1
• DSM 7.3.2 before 7.3.2-86009-5
• DSM 7.2.2 before 7.2.2-72806-10
• DSM 7.2.1 before 7.2.1-69057-13

Fixed versions:

• DSM 7.4: 7.4.1-90080-1 or later
• DSM 7.3: 7.3.2-86009-5 or later
• DSM 7.2.2: 7.2.2-72806-10 or later
• DSM 7.2.1: 7.2.1-69057-13 or later

Refer to Synology security advisory SA-26:19 for the official vendor details.

Exploitation Status

• Public disclosure around 10–12 November 2026 via Synology SA-26:19.
• Unauthenticated remote exploitation is possible.
• Public proof-of-concept material has been reported.
• No widespread in-the-wild exploitation confirmed as of this advisory’s publication.
• Not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing.

Recommendations

1. Immediate Action: Upgrade DSM to the fixed build for your branch (7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10, or 7.2.1-69057-13) or a later release.
2. Apply the update through the official DSM update mechanism and reboot if required by the package.
3. Prioritize any DSM devices that are reachable from the internet or from untrusted networks. Inventory all Synology NAS appliances in the environment and confirm their DSM versions.
4. Where possible, restrict access to DSM management and authentication interfaces to trusted administrative networks only (VPN, management VLAN, or IP allow-listing).
5. Review device logs and network telemetry for unusual requests to authentication-related endpoints around and after the disclosure window.
6. If compromise is suspected, treat the device as compromised: isolate it, preserve forensic evidence, rotate credentials and shared secrets stored on or used by the NAS, and perform a full integrity review before returning it to service.
7. Ensure automatic update checks are enabled where operationally acceptable, and subscribe to Synology security advisories for future notifications.

Given the critical severity, lack of required authentication, and the large installed base of Synology DSM devices in both enterprise and SMB environments, organizations should treat this as an emergency patch for any exposed or internet-facing systems.

Karen IT
We make the Internet harder to abuse.