CVE Feed

    Dashboard / CVE / CVE-2026-76954

    CVE-2026-76954

    An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

    Published:Nov 12, 2026
    Last Modified:Nov 13, 2026
    EPS:Nov 12, 2026
    EPSS Score:0.00634
    CVSS Score:9.8

    Affected Products

    Vendor
    Synology
    Product
    Diskstation Manager

    Exploits

    https://github.com/ansonhsu-ai/synology-dsm-cve-2026-76954-ste

    Related CVEs

    CVE-2026-85101 (CVSS 8.6) — An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation…
    CVE-2026-88266 (CVSS 4.3) — An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation …
    CVE-2026-81559 (CVSS 4.3) — A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.…
    CVE-2026-81558 (CVSS 4.3) — A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-8…
    CVE-2026-77738 (CVSS 4.3) — A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before…
    CVE-2026-74850 (CVSS 4.3) — An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology…
    CVE-2026-19414 (CVSS 4.3) — A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-…
    CVE-2026-85098 (CVSS 5.3) — A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5…
    CVE-2026-124993 (CVSS 5.3) — An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before …
    CVE-2026-92379 (CVSS 5.4) — An improper neutralization of input during web page generation vulnerability in the Notification API in Synolo…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High