www.it-connect.fr
Synology NAS: Two Unauthenticated DSM Flaws Expose SQL Injection Risk
Do you manage a Synology NAS? A new security alert has been issued, and it concerns critical vulnerabilities discovered in DSM. Among them are two flaws that can be exploited remotely without authentication. Here’s how to protect yourself.
Synology has published two security advisories for DSM, the operating system used by its NAS devices. The first one (SA-26:19) is considered critical. And for good reason: it fixes two vulnerabilities that an attacker can exploit without having any account on the NAS, which is a major risk for devices exposed on the Web. The second one (SA-26:18) groups 25 other security flaws, some of which are considered important.
As a reminder, on September 18, Synology had already published an advisory (SA-26:13) after fixing two critical flaws (CVE-2026-13639 and CVE-2026-13684) with very similar consequences. Not long ago, I also published an article about the wave of C3RB3R ransomware attacks against Synology NAS devices, for which the Chinese vendor 360 identified these two flaws as the entry point. There is real tension around the Synology ecosystem right now.
The two new critical vulnerabilities
Here is what we know about the two new critical flaws patched by Synology:
- CVE-2026-76954 (CVSS 9.8 / 10): a SQL injection (a malicious query that hijacks the internal database) in the Auth API, the DSM component that handles sign-in. A remote unauthenticated attacker can read or write arbitrary files, and trigger a denial of service, meaning the NAS or some services can become unavailable.
- CVE-2026-85101 (CVSS 8.6 / 10): an authentication bypass in rsync. As a reminder, this service allows other machines to synchronize or back up files to the NAS. Again, without authentication, the attacker can read certain files, write arbitrary files, and trigger a denial of service.
The first flaw seems to me the most concerning. The Auth API is used as soon as the DSM login page loads: a NAS whose web interface is reachable from the Internet is therefore the most exposed. Synology does not mention code execution, but being able to write arbitrary files on a Linux system remains a very interesting path to compromise a device.
For the second vulnerability, it mainly depends on your NAS configuration: the rsync service must be enabled on the NAS (Control Panel, then File Services, rsync tab). It is disabled by default.
DSM: which versions should you install on your NAS?
Here is the minimum version to install for each of the four affected DSM branches:
- DSM 7.4: 7.4.1-90080-1 or later.
- DSM 7.3: 7.3.2-86009-5 or later.
- DSM 7.2.2: 7.2.2-72806-10 or later.
- DSM 7.2.1: 7.2.1-69057-13 or later.
To check your version and start the update, go to Control Panel, then Update & Restore. Note: the versions that fixed the September flaws (7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, and 7.2.1-69057-12) do not protect you against these vulnerabilities. On branch 7.4, which is currently the latest, you must move to DSM 7.4.1-90080-1. If it is not yet available to you (phased rollout), download it from Synology's Download Center.
Versions 7.4.1-90080-1 and 7.3.2-86009-5 also fix the 25 security flaws mentioned in Synology's second advisory. Among these vulnerabilities, three of them, rated 8.8 out of 10 (in SSOAuth, the Sharing API, and the Auth API), allow an authenticated user to read or write arbitrary files. Others are exploitable without authentication, with a lower impact, such as a denial of service via the NFS service or reading certain files via WebDAV.
If your NAS is not up to date, now is the time to patch it. There have already been two critical alerts focused on the DSM system itself in less than two months, and, above all, an active ransomware campaign. However, these new vulnerabilities do not appear to be exploited at the moment.
