Synology released DiskStation Manager updates that fix 27 vulnerabilities, including CVE-2026-76954, a CVSS 9.8 SQL injection flaw in the Auth API that lets an unauthenticated attacker read and write arbitrary files and cause denial of service.
There is no known exploitation and no public exploit. Synology offers no workarounds, so updating DSM is the only remedy.
CVE-2026-76954 Gives Unauthenticated Access Through the Auth API
The critical flaw is a SQL injection in DSM’s Auth API. Because the flaw requires no authentication, an attacker who can reach the interface can read and write arbitrary files on the device and trigger denial of service. The 9.8 CVSS score reflects that combination of network reachability, absence of credentials and broad impact.
The Auth API is the component that handles login, so the flaw sits at the entry point to the device rather than behind it. That placement is what makes a pre-authentication bug in a login path so serious.
Other Notable DSM Vulnerabilities in the Release
CVE-2026-85101, rated 8.6, is an rsync login bypass that provides file access and limited denial of service. CVE-2026-13672, rated 8.8, is also highlighted among the release’s more serious bugs.
Breakdown of the 27 Synology Fixes by Severity
The 27 flaws break down into one critical, nine high-severity and 17 medium-severity issues. The single critical bug is CVE-2026-76954. The volume of high-severity fixes means that administrators should apply the full update rather than treating the SQL injection as the only reason to patch.
DSM Versions That Receive Fixes
Synology fixed the flaws in DSM 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10 and 7.2.1-69057-13. The affected product lines are DSM 7.4, 7.3, 7.2.2 and 7.2.1, covering four maintained branches. Each branch has its own patched build, so administrators can stay within the version family they already run.
Why Exposed NAS Devices Attract Attackers
Network-attached storage devices hold backups, shared files and, in many small organizations, the only copy of business data. The reporting on this release notes that NAS devices are common targets for ransomware and botnet operators, which gives even an unexploited flaw some urgency.
A pre-authentication bug with file read and write capability is the kind of weakness that those groups can use at scale if a working exploit appears. At the time of the update, no public exploit is available, which gives administrators a window that is likely to narrow after details circulate.
Devices that expose DSM management to the internet carry the highest risk. Synology provides no workaround for the flaws, so reducing exposure means limiting which networks can reach the device while the update is scheduled. For devices behind firewalls or accessible only over a VPN, the practical risk is lower, though the fix is still advisable because internal attackers or compromised internal hosts could reach the vulnerable Auth API.
The absence of confirmed attacks does not change the update’s priority. Given the 9.8 score, the file-write capability and the lack of any alternative mitigation, administrators of DiskStation devices running any affected DSM branch have a clear reason to apply the fixed build promptly.
The rsync Login Bypass and Remaining High-Severity Issues
CVE-2026-85101 is worth separate attention because rsync is a common service for backups and file synchronization on NAS devices. A login bypass there gives file access, and the limited denial-of-service impact adds to the risk for backup workflows. CVE-2026-13672, rated 8.8, is also among the high-severity fixes.
Together with the critical SQL injection, those issues mean DSM updates should not be deferred for the sake of a single flaw. All four maintained DSM branches received fixes in this release, so no supported branch requires a version jump to become patched.
