Synology’s Synology-SA-26:19 puts a Critical DDoS-adjacent risk in DSM on the record. The advisory assigns CVE-2026-76954 a CVSS 3.1 score of 9.8 for a network-reachable SQL injection flaw in the DSM Auth API. Users of DSM 7.4, 7.3, 7.2.2, and 7.2.1 are told to move to the fixed build for their train or a later build.
Synology-SA-26:19 and CVE-2026-76954
Synology published the advisory on 10 November 2026 at 17:06:42 UTC+8, and the record later showed 11:06:42 Asia/Jerusalem. The advisory is revision 1 and carries the label “Initial public release.”
CVE-2026-76954 is the more severe of the two issues in the advisory. Its CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means the flaw is reachable over the network, needs no privileges, and needs no user interaction.
DSM Auth API and access scope
Synology says the flaw sits in the DSM Auth API, not in a user setting or a local-only path. That gives an attacker a remote route into authentication handling itself, which is why the impact text goes beyond simple login abuse and says remote attackers can read or write arbitrary files and conduct denial-of-service attacks.
Nguyễn Bá Nam Dũng and Hà Thế Long of Viettel Cyber Security Research Lab are credited in the CVE record for CVE-2026-76954. Synology also lists CWE-89 for the issue, the standard bucket for SQL injection.
What Synology said to do
Synology’s mitigation line is “None.” The remediation line instead tells users to upgrade to the fixed build for the affected DSM train, or to a later build, so the practical task is not tuning a setting but moving off the vulnerable release.
The advisory covers DSM 7.4, 7.3, 7.2.2, and 7.2.1. Synology did not list any other DSM trains in the advisory.
Why the 9.8 score still needs caution
The harder part for defenders is that Synology assigns CVE-2026-76954 a Critical 9.8 score, yet the advisory does not discuss exploitation in the wild, and neither CVE was in CISA’s Known Exploited Vulnerabilities catalog as of 2026.11.10. That makes the issue severe on paper and operationally urgent, but not evidence of active mass abuse.
Synology published the CVE-2026-85101 record on 12 November 2026 at 03:40:28 UTC and the CVE-2026-76954 record at 03:41:52 UTC. Users of DSM still need the fixed build for their own train, because the advisory gives no separate exception for older deployments and no slower path than upgrading.
