Synology DSM 7.2–7.4: 27 CVEs in two advisories, including arbitrary file read/write, DoS and SSRF flaws
On 10 November 2026 Synology published two DSM advisories, Synology-SA-26:18 and Synology-SA-26:19, covering Synology DiskStation Manager (DSM) 7.2, 7.3 and 7.4. The CERT-FR bulletin lists 27 CVE identifiers and classes their effects as confidentiality breaches, security policy bypasses, remote denial of service and server-side request forgery (SSRF). According to the vendor, the flaws let an attacker read or write arbitrary files or trigger denial of service, and most of them require an authenticated user, so exposure depends on who holds an account on the NAS. The highest CVSS 3.1 score in SA-26:18 is 8.8, and the vendor's index page rates SA-26:19 Critical, but that advisory's detail page was not retrieved during research. Neither the article nor the vendor pages report exploitation in the wild, and the vendor lists no mitigation other than patching, so the urgency is rated high.
Entenda a falha
A vulnerabilidade
Synology published advisories SA-26:18 and SA-26:19 on 10 November 2026, covering 27 CVEs in DSM. The most severe in SA-26:18 are CVE-2026-13672 (SSOAuth, user-controlled key), CVE-2026-18792 (Sharing API, path traversal) and CVE-2026-74857 (Auth API, missing authentication step), all rated 8.8 and needing an authenticated user. CVE-2026-81584 (SQL injection in the User API, 8.1) needs a compromised LDAP or Active Directory server. Without credentials: CVE-2026-18633 (nfsd, DoS, 7.5), CVE-2026-15198 (WebDAV, 6.5), CVE-2026-124993 (Security Advisor, file read) and CVE-2026-85098 (synoscgi). CVE-2026-77738 is an SSRF in the Credential API. Other CVEs, including CVE-2026-76954 and CVE-2026-85101, are unverified; the SA-26:19 detail page (rated Critical on the index) was not retrieved. Affected: DSM 7.2.1 before 7.2.1-69057-13, 7.2.2 before 7.2.2-72806-10, 7.3 before 7.3.2-86009-5, 7.4 before 7.4.1-90080-1.
Como funciona
The articles do not describe the internal flow of each flaw in detail. In general, a request reaches a DSM component such as the Sharing API, Auth API, SSOAuth, WebDAV, nfsd or the Credential API. For the authenticated flaws, the component trusts a user-supplied key or path, or skips an authentication step, and so reads or writes files it should not. In the unauthenticated denial-of-service cases, the nfsd uninitialized pointer and the reachable assertion in synoscgi are hit and the service fails. In the SSRF, the server is made to issue requests on the attacker's behalf.
Por que é vulnerável
The root causes are classes of weakness named in the advisories: a user-controlled key (SSOAuth), path traversal (Sharing API), a missing authentication step (Auth API) and missing authentication in WebDAV, incorrect authorization (Security Advisor), an uninitialized pointer (nfsd), a reachable assertion (synoscgi) and SQL injection (User API). The articles do not say why they went unnoticed or what exactly each patch changes. The fix is to upgrade DSM to the fixed builds.
Onde está
The articles name only DSM components, not files or functions: SSOAuth, Sharing API, Auth API, User API, Credential API, WebDAV, nfsd, Security Advisor and synoscgi.
Como foi descoberta
The articles do not say who found the flaws or how. They reached the public through Synology's advisories SA-26:18 and SA-26:19, published on 10 November 2026, and a CERT-FR bulletin the same day. Neither the CERT-FR article nor the vendor pages report exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:36.
Detalhes técnicos
Synology's SA-26:18 covers DSM 7.3 and 7.4, lists 25 CVEs, and rates them Important with CVSS 3.1 scores from 4.3 to 8.8 (synology.com). The top-scored entries are authorization and path-handling flaws that need an authenticated user: CVE-2026-13672 in SSOAuth (user-controlled key, 8.8), CVE-2026-18792 in the Sharing API (path traversal, 8.8) and CVE-2026-74857 in the Auth API (missing authentication step, 8.8) (synology.com). Entries that do not need credentials are limited to denial of service or read access: CVE-2026-18633 in nfsd (uninitialized pointer, 7.5, DoS), CVE-2026-15198 in WebDAV (missing authentication, 6.5), CVE-2026-124993 in Security Advisor (incorrect authorization, file read, 5.3) and CVE-2026-85098 in synoscgi (reachable assertion, 5.3) (synology.com). The SSRF is CVE-2026-77738 in the Credential API, rated 4.3 and requiring an authenticated user (synology.com). CVE-2026-81584, a SQL injection in the User API rated 8.1, requires an attacker who controls a compromised LDAP or Active Directory server (synology.com). The CERT-FR list also includes CVE-2026-76954 and CVE-2026-85101, which are absent from SA-26:18; they are presumably in SA-26:19, whose detail page was not retrieved, so their details are unverified. The CERT-FR article gives no CVSS scores or prerequisites (cert.cyber.gouv.fr).
Remediação
Upgrade to DSM 7.2.1-69057-13 or later on the 7.2.1 branch and 7.2.2-72806-10 or later on the 7.2.2 branch (cert.cyber.gouv.fr), to 7.3.2-86009-5 or later on 7.3, and to 7.4.1-90080-1 or later on 7.4 (synology.com). The SA-26:18 advisory lists no mitigation other than the update (synology.com). Because most flaws need a valid account, review user accounts and LDAP or Active Directory links, restrict exposure of the DSM web interface, and check logs for unexpected file changes.
Linha do tempo
-
Synology DSM 7.2–7.4: 27 CVEs in two advisories, including arbitrary file read/write, DoS and SSRF flaws
ler a análise desta fonte ocultar
On 10 November 2026 Synology published two DSM advisories, Synology-SA-26:18 and Synology-SA-26:19, covering Synology DiskStation Manager (DSM) 7.2, 7.3 and 7.4. The CERT-FR bulletin lists 27 CVE identifiers and classes their effects as confidentiality breaches, security policy bypasses, remote denial of service and server-side request forgery (SSRF). According to the vendor, the flaws let an attacker read or write arbitrary files or trigger denial of service, and most of them require an authenticated user, so exposure depends on who holds an account on the NAS. The highest CVSS 3.1 score in SA-26:18 is 8.8, and the vendor's index page rates SA-26:19 Critical, but that advisory's detail page was not retrieved during research. Neither the article nor the vendor pages report exploitation in the wild, and the vendor lists no mitigation other than patching, so the urgency is rated high.
Technical Details
Synology's SA-26:18 covers DSM 7.3 and 7.4, lists 25 CVEs, and rates them Important with CVSS 3.1 scores from 4.3 to 8.8 (synology.com). The top-scored entries are authorization and path-handling flaws that need an authenticated user: CVE-2026-13672 in SSOAuth (user-controlled key, 8.8), CVE-2026-18792 in the Sharing API (path traversal, 8.8) and CVE-2026-74857 in the Auth API (missing authentication step, 8.8) (synology.com). Entries that do not need credentials are limited to denial of service or read access: CVE-2026-18633 in nfsd (uninitialized pointer, 7.5, DoS), CVE-2026-15198 in WebDAV (missing authentication, 6.5), CVE-2026-124993 in Security Advisor (incorrect authorization, file read, 5.3) and CVE-2026-85098 in synoscgi (reachable assertion, 5.3) (synology.com). The SSRF is CVE-2026-77738 in the Credential API, rated 4.3 and requiring an authenticated user (synology.com). CVE-2026-81584, a SQL injection in the User API rated 8.1, requires an attacker who controls a compromised LDAP or Active Directory server (synology.com). The CERT-FR list also includes CVE-2026-76954 and CVE-2026-85101, which are absent from SA-26:18; they are presumably in SA-26:19, whose detail page was not retrieved, so their details are unverified. The CERT-FR article gives no CVSS scores or prerequisites (cert.cyber.gouv.fr).
Remediation
Upgrade to DSM 7.2.1-69057-13 or later on the 7.2.1 branch and 7.2.2-72806-10 or later on the 7.2.2 branch (cert.cyber.gouv.fr), to 7.3.2-86009-5 or later on 7.3, and to 7.4.1-90080-1 or later on 7.4 (synology.com). The SA-26:18 advisory lists no mitigation other than the update (synology.com). Because most flaws need a valid account, review user accounts and LDAP or Active Directory links, restrict exposure of the DSM web interface, and check logs for unexpected file changes.