Synology DSM Updates Fix Critical SQL Injection and rsync Authentication Bypass

Quick Answer

Apply the fixed DSM build for each supported branch. Inventory exposed management and file services, preserve relevant logs, and validate authentication, access controls, backups and replication after the update.

Last verified: 2026-11-10 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	Synology DiskStation Manager (DSM)
Advisory	Synology-SA-26:19
CVEs	CVE-2026-76954, CVE-2026-85101
Authoritative release date	November 10, 2026 at 17:06:42 UTC+8 (09:06:42 UTC), from Synology.
Authority revision date	Initial public release; the published and last-updated timestamps are identical.
Affected versions	DSM 7.4, 7.3, 7.2.2 and 7.2.1 before their branch-specific fixed builds below.
Fixed version	DSM 7.4: 7.4.1-90080-1; DSM 7.3: 7.3.2-86009-5; DSM 7.2.2: 7.2.2-72806-10; DSM 7.2.1: 7.2.1-69057-13 or later in the corresponding branch
CVSS base score	9.8 (CVE-2026-76954); 8.6 (CVE-2026-85101), CVSS v3.1 base scores
CVSS severity	Critical
Exploitation status	Synology does not state malicious exploitation in this advisory.; no exploitation claim is inferred.

What Changed

Synology corrected unauthenticated Auth API SQL injection (CVE-2026-76954) and an rsync authentication bypass (CVE-2026-85101). The first can permit arbitrary file reads and writes and denial of service; the second permits specific file reads, arbitrary writes and limited denial of service.

What To Validate Now

1. Inventory. Record NAS model, DSM branch and complete build, installed packages, service exposure, directory integration and storage owners.
2. Establish applicability. Use the exact branch mapping and per-CVE prerequisites in the advisory. NAS presence alone does not establish compromise or exposure to every listed issue.
3. Remediate. Install the corresponding fixed DSM build or later through supported Synology update channels. The advisory lists no mitigation.
4. Validate. Confirm the complete running DSM build and test approved management sign-in, file permissions, backups and replication. Review relevant authentication and file-service logs where exposure existed; retain deployment and validation results.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Coordinate NAS availability, recoverability and dependent applications before maintenance. A completed update does not establish that earlier file or account activity was legitimate. Do not apply a build intended for a different branch or device.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• Synology-SA-26:19

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.