CVE-2026-76954 is a critical SQL injection vulnerability in the Auth API of Synology DiskStation Manager (DSM) that lets remote attackers read or write arbitrary files and cause a denial of service.
What Is It
CVE-2026-76954 is an "improper neutralization of special elements used in an SQL command" flaw (CWE-89, SQL injection). It sits in the Auth API of Synology DiskStation Manager (DSM). Synology's description says remote attackers can use it to read or write arbitrary files and to carry out denial-of-service attacks.
Synology ([email protected]) published the record on November 12, 2026. NVD lists its status as "Received," which means NVD has not finished its own analysis yet.
Why It Matters
Synology gave the flaw a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Impact: High for confidentiality, integrity and availability
An unauthenticated attacker who can reach the service over the network may be able to read and write arbitrary files and disrupt the system, all without user interaction. The flaw is in the authentication component, which raises the stakes further.
As of this writing, CVE-2026-76954 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation.
What's Vulnerable
Synology DiskStation Manager (DSM) is affected in these branches when running versions earlier than the listed fixed builds:
| Branch | Affected before |
|---|---|
| DSM 7.4.1 | 7.4.1-90080-1 |
| DSM 7.3.2 | 7.3.2-86009-5 |
| DSM 7.2.2 | 7.2.2-72806-10 |
| DSM 7.2.1 | 7.2.1-69057-13 |
The vendor lists DSM versions older than 7.2.1 with an "unknown" status. The record does not say whether those releases are vulnerable.
Patch Status
Synology has released fixed builds for each affected branch. Administrators should upgrade to the following builds or later:
- 7.4.1-90080-1
- 7.3.2-86009-5
- 7.2.2-72806-10
- 7.2.1-69057-13
Synology advisory Synology_SA_26_19 has the vendor's full guidance. Because the flaw is in an unauthenticated network-facing API and carries a 9.8 score, patching should be a priority even without KEV-confirmed exploitation. Systems on DSM versions before 7.2.1 have no stated fix in the record and should be checked against the vendor advisory.
Sources
- Synology Security Advisory Synology_SA_26_19
- NVD: CVE-2026-76954
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)