Synology has patched CVE-2026-76954, a critical SQL injection flaw in DiskStation Manager (DSM) scored 9.8 out of 10, which a remote attacker can exploit without logging in. The flaw sits in DSM's Auth API and can let an attacker read or write arbitrary files and cause a denial-of-service attack, so owners of NAS devices — especially any reachable from the internet — should update to a fixed DSM build now.

The fix is in security advisory Synology-SA-26:19, first published on 10 November 2026. Synology lists no workaround for the flaw, which means patching is the only protection it offers. There is no confirmed evidence of active exploitation, but the combination of a maximum-impact score and no login requirement makes this one to treat as urgent.

What CVE-2026-76954 is

CVE-2026-76954 is an SQL injection vulnerability, classed as CWE-89, in the Auth API of Synology DiskStation Manager. Synology's advisory says the flaw affects DSM versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5 and 7.4.1-90080-1, and that it allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Its CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms, that means the flaw can be reached over the network, needs low attack complexity, needs no privileges and no user interaction, and can affect the confidentiality, integrity and availability of the system. That is why Synology rates it Critical, with a base score of 9.8.

The researchers credited in the advisory are Nguyen Ba Nam Dung and Ha The Long, from Viettel Cyber Security Research Lab, and Warisse Valentin. Their work was acknowledged by Synology alongside the release of the fix.

Which DSM versions are affected

The flaw affects four DSM branches: DSM 7.4, DSM 7.3, DSM 7.2.2 and DSM 7.2.1. Synology says owners should upgrade to 7.4.1-90080-1 or above for DSM 7.4, 7.3.2-86009-5 or above for DSM 7.3, 7.2.2-72806-10 or above for DSM 7.2.2, and 7.2.1-69057-13 or above for DSM 7.2.1.

Administrators should check the exact build number on their device rather than relying on the headline version alone, because the fix is tied to the specific build. DSM can be updated from Control Panel, under Update and Restore, or through the DSM update page in the Synology Download Centre. After updating, it is worth confirming the new build number is shown and that file services, backups and remote access are working as expected.

Second flaw fixed in the same update

The same advisory also fixes CVE-2026-85101, an authentication bypass in the rsync service in DSM, scored 8.6 and rated Important. Synology says that flaw, classed as CWE-288, allows remote attackers to read specific files, write arbitrary files and conduct limited denial-of-service attacks, and it affects the same DSM versions before the same fixed builds.

SecurityOnline, reporting on both Synology-SA-26:19 and the companion bulletin Synology-SA-26:18, counts 27 flaws fixed across the two reports, with one Critical, nine High and 17 Medium severity issues. Neither Synology nor that report confirms any active attacks or public exploit code for these flaws. That is reassuring, but it is not a reason to delay: flaws of this severity in internet-facing storage devices are routinely probed once the details become public.

What to do now

Update DSM to a fixed build as soon as possible, starting with any NAS device that is exposed to the internet or used to store backups and business files. If a device cannot be updated immediately, restrict who can reach its management interface, for example by limiting access to trusted networks and turning off any remote access that is not needed.

Owners should also review who has an account on the device, check that backups are separate from the NAS itself and still restorable, and watch for unusual file changes or failed login attempts after the update. A NAS holds copies of the files a household or business cares about most, so a flaw that allows files to be read or changed without a login deserves a fast response.

Source: Synology security advisory Synology-SA-26:19. Further reporting: SecurityOnline.