CVE Feed

    Dashboard / CVE / CVE-2026-85101

    CVE-2026-85101

    An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.

    Published:Nov 12, 2026
    Last Modified:Nov 13, 2026
    EPS:Nov 12, 2026
    EPSS Score:0.00576
    CVSS Score:8.6

    Affected Products

    Vendor
    Synology
    Product
    Diskstation Manager

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-127 Directory Indexing
    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-76954 (CVSS 9.8) — An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synolog…
    CVE-2026-88266 (CVSS 4.3) — An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation …
    CVE-2026-81559 (CVSS 4.3) — A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.…
    CVE-2026-81558 (CVSS 4.3) — A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-8…
    CVE-2026-77738 (CVSS 4.3) — A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before…
    CVE-2026-74850 (CVSS 4.3) — An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology…
    CVE-2026-19414 (CVSS 4.3) — A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-…
    CVE-2026-85098 (CVSS 5.3) — A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5…
    CVE-2026-124993 (CVSS 5.3) — An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before …
    CVE-2026-92379 (CVSS 5.4) — An improper neutralization of input during web page generation vulnerability in the Notification API in Synolo…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High