Osegi
Security·2 min read

Synology patches 27 DSM flaws, including a critical 9.8 bug

Synology fixed 27 DSM vulnerabilities on 10 November, two of which let attackers write files remotely without a password. The worst scores 9.8 out of 10.

A Synology NAS device on a desk with a security warning symbol on a connected screen.
Image: Frandroid
SUMODialoediviewergiftdetect

Synology has released fixes for 27 vulnerabilities in DSM, the operating system of its NAS devices. Two of them allow an attacker to write files remotely without any password. The security advisory, referenced Synology-SA-26:19, was published on Tuesday 10 November at 10:06 Paris time.

The most serious flaw, CVE-2026-76954, sits in the Auth API, the DSM module that handles user logins. It is an SQL injection, a technique that slips commands into an input field so the system's database executes them. Synology rates it 9.8 out of 10 on the CVSS scale, the "critical" level. It needs no credentials and no action from the victim, and it can be used to read or write any file, or even crash the NAS.

The second flaw, CVE-2026-85101, affects rsync, the service that synchronizes and backs up files between two machines. It bypasses authentication through an alternate path and allows writing any file, but only reading some. Synology rates it "important" at 8.6 out of 10.

Every recent DSM branch is affected

The advisory targets DSM versions rather than specific models: 7.4, 7.3, 7.2.2 and 7.2.1. Any Synology NAS running one of these without the latest patch is exposed. Synology says no workaround exists, so updating is the only protection. The company does not report any attack exploiting these flaws so far.

It is the second alert of this severity in two months. On 18 September, Synology fixed two other DSM flaws rated 9.8 that also allowed remote file reads or writes.

How to update

Open DSM, then Control Panel, then Update & Restore, where you can see the installed version and launch the update. The minimum fixed versions are:

  • DSM 7.4: 7.4.1-90080-1 or later
  • DSM 7.3: 7.3.2-86009-5 or later
  • DSM 7.2.2: 7.2.2-72806-10 or later
  • DSM 7.2.1: 7.2.1-69057-13 or later

If you cannot update right away, cut the NAS's access from the internet in the meantime.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:synologydsmnasvulnerabilitycvesecurity update

More from this day

See all →

More in: Security

See all →