Synology DSM Updates Fix Authentication, File Access and Service Flaws
Tech GuruQuick Answer
Apply the fixed DSM build for each supported branch. Inventory exposed management and file services, preserve relevant logs, and validate authentication, access controls, backups and replication after the update.
Confirm Scope And Apply The Supported Remediation
What to do now: Record NAS model, DSM branch and complete build, installed packages, service exposure, directory integration and storage owners. Use the exact branch mapping and per-CVE prerequisites in the advisory. NAS presence alone does not establish compromise or exposure to every listed issue. Install the corresponding fixed DSM build or later through supported Synology update channels. The advisory lists no mitigation. Confirm the complete running DSM build and test approved management sign-in, file permissions, backups and replication. Review relevant authentication and file-service logs where exposure existed; retain deployment and validation results.
Last verified: 2026-11-10 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Synology DiskStation Manager (DSM) |
|---|---|
| Advisory | Synology-SA-26:18 |
| CVEs | CVE-2026-124993, CVE-2026-13656, CVE-2026-13672, CVE-2026-15198, CVE-2026-15201, CVE-2026-16550, CVE-2026-18596, CVE-2026-18633, CVE-2026-18792, CVE-2026-19048, CVE-2026-19414, CVE-2026-19833, CVE-2026-74850, CVE-2026-74857, CVE-2026-75785, CVE-2026-77738, CVE-2026-81557, CVE-2026-81558, CVE-2026-81559, CVE-2026-81584, CVE-2026-85098, CVE-2026-86343, CVE-2026-87801, CVE-2026-88266, CVE-2026-92379 |
| Authoritative release date | November 10, 2026 at 17:06:33 UTC+8 (09:06:33 UTC), from Synology. |
| Authority revision date | Initial public release; the published and last-updated timestamps are identical. |
| Affected versions | DSM 7.4 before 7.4.1-90080-1 and DSM 7.3 before 7.3.2-86009-5. This advisory does not extend the 25-issue scope to DSM 7.2 branches. |
| Fixed version | DSM 7.4: 7.4.1-90080-1; DSM 7.3: 7.3.2-86009-5 or later in the corresponding branch |
| CVSS base score | 8.8 maximum CVSS v3.1 base score; individual scores range from 4.3 to 8.8 |
| CVSS severity | Important / Moderate (Synology severity labels) |
| Exploitation status | Synology does not state malicious exploitation in this advisory.; no exploitation claim is inferred. |
What Changed
Synology issued fixes for 25 DSM vulnerabilities spanning authentication and authorization, file handling, network services and web interfaces. Attack requirements differ: some issues are unauthenticated, while others require a user, administrator, compromised directory server or interaction.
What To Validate Now
- Inventory. Record NAS model, DSM branch and complete build, installed packages, service exposure, directory integration and storage owners.
- Establish applicability. Use the exact branch mapping and per-CVE prerequisites in the advisory. NAS presence alone does not establish compromise or exposure to every listed issue.
- Remediate. Install the corresponding fixed DSM build or later through supported Synology update channels. The advisory lists no mitigation.
- Validate. Confirm the complete running DSM build and test approved management sign-in, file permissions, backups and replication. Review relevant authentication and file-service logs where exposure existed; retain deployment and validation results.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Coordinate NAS availability, recoverability and dependent applications before maintenance. A completed update does not establish that earlier file or account activity was legitimate. Do not apply a build intended for a different branch or device.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
