EN PT-BR
← Voltar ao feed
critical

Synology DSM 7.2–7.4: 27 CVEs fixed in SA-26:18 and SA-26:19, including a reported 9.8 pre-auth SQL injection (CVE-2026-76954)

2 fonte(s) · 2 atualização(ões) · publicado 09/11/2026 21:00 · coletado há 10 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 11/11/2026 00:01; os links antigos trazem para cá.

Fontes: securityonline.info ↗ cert.cyber.gouv.fr ↗

On 10 November 2026 Synology published two advisories, Synology-SA-26:18 and Synology-SA-26:19, covering DiskStation Manager (DSM) 7.2, 7.3 and 7.4 and fixing 27 CVEs in total (cert.cyber.gouv.fr, securityonline.info). The flaws allow arbitrary file read or write, remote denial of service, security policy bypass and SSRF (cert.cyber.gouv.fr). Most of them require an authenticated user, so exposure depends on who holds an account on the NAS (cert.cyber.gouv.fr). The exception is CVE-2026-76954, which securityonline.info describes as a critical SQL injection (CVSS 9.8) and which Viettel Cyber Security researchers reportedly listed as a pre-auth, zero-click remote code execution flaw. Neither source reports exploitation in the wild, and the only remediation is to install the fixed DSM builds, since no workaround exists.

Entenda a falha

A vulnerabilidade

Synology DiskStation Manager (DSM) received 27 CVE fixes in advisories SA-26:18 and SA-26:19. The most severe is CVE-2026-76954 (CVSS 9.8 per securityonline.info), an SQL injection (CWE-89) in the Auth API. Per the vendor quote, a remote unauthenticated attacker can read or write arbitrary files and cause denial of service. CVE-2026-85101 (8.6) is a login bypass (CWE-288) in rsync that allows reading specific files, writing arbitrary files and limited DoS. SA-26:18 adds mostly authenticated flaws: CVE-2026-13672 (SSOAuth), CVE-2026-18792 (Sharing API, path traversal) and CVE-2026-74857 (Auth API), all 8.8. It also lists CVE-2026-81584 (User API SQL injection via a rogue LDAP/AD server, 8.1), CVE-2026-18633 (nfsd, 7.5), CVE-2026-15198 (WebDAV, 6.5) and CVE-2026-77738 (Credential API SSRF, 4.3). Fixed in 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5 and 7.4.1-90080-1. No workarounds exist.

Como funciona

For CVE-2026-76954, a network request reaches the DSM Auth API without any login. The articles do not detail the internal steps, but with an SQL injection, data from the request ends up inside a database query and is interpreted as part of the query rather than as plain data. That lets the attacker go beyond what the API should allow, and the vendor says the result is arbitrary file read or write and denial of service. In the rsync flaw, the authentication step that should gate access can be bypassed, so a remote client gets file access without valid credentials. The authenticated flaws need a valid account first, and CVE-2026-81584 needs the attacker to control the LDAP or Active Directory server DSM talks to.

Por que é vulnerável

CVE-2026-76954 is classified as CWE-89: the Auth API does not properly neutralize input before using it in an SQL query. CVE-2026-85101 is classified as CWE-288, an authentication bypass in rsync through an alternate path that skips the login check. Other entries in SA-26:18 include a missing authentication step (CVE-2026-74857), path traversal (CVE-2026-18792) and an uninitialized pointer (CVE-2026-18633). The articles do not say why the flaws went unnoticed or what the patches change in the code; the fix ships as updated DSM builds.

Onde está

The advisories name components only: the Auth API (CVE-2026-76954), rsync (CVE-2026-85101), SSOAuth, Sharing API, nfsd, WebDAV and User API in DSM; the articles name no files, functions or commits.

Como foi descoberta

The articles do not say who found the flaws or how. Synology disclosed them on 10 November 2026 in advisory SA-26:19 (two unauthenticated flaws, rated Critical in the vendor index per CERT-FR) and SA-26:18 (25 flaws). securityonline.info says Viettel Cyber Security researchers listed CVE-2026-76954 as a pre-auth, zero-click remote code execution flaw, which goes beyond the vendor's description of file read/write and DoS. CERT-FR lists the CVE but says its details were not verified. No exploitation in the wild is reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 00:16.

Detalhes técnicos

SA-26:18 covers DSM 7.3 and 7.4, lists 25 CVEs and rates them Important, with CVSS 3.1 scores from 4.3 to 8.8 (cert.cyber.gouv.fr, citing the vendor advisory). The top-scored entries need an authenticated user (cert.cyber.gouv.fr):

  • CVE-2026-13672: SSOAuth, user-controlled key, 8.8.
  • CVE-2026-18792: Sharing API, path traversal, 8.8.
  • CVE-2026-74857: Auth API, missing authentication step, 8.8.

Several entries do not need credentials, but they are limited to denial of service or read access (cert.cyber.gouv.fr):

  • CVE-2026-18633: nfsd, uninitialized pointer, 7.5, DoS.
  • CVE-2026-15198: WebDAV, missing authentication, 6.5.
  • CVE-2026-124993: Security Advisor, incorrect authorization, file read, 5.3.
  • CVE-2026-85098: synoscgi, reachable assertion, 5.3.

The SSRF is CVE-2026-77738 in the Credential API, rated 4.3 and requiring an authenticated user (cert.cyber.gouv.fr). CVE-2026-81584 is a SQL injection in the User API, rated 8.1, that requires the attacker to control a compromised LDAP or Active Directory server (cert.cyber.gouv.fr).

The CERT-FR list also includes CVE-2026-76954 and CVE-2026-85101, which are absent from SA-26:18. They are presumably covered by SA-26:19, whose detail page was not retrieved, so their details are unverified (cert.cyber.gouv.fr). The vendor index rates SA-26:19 Critical (cert.cyber.gouv.fr). The CERT-FR bulletin itself gives no CVSS scores or prerequisites.

Remediação

Upgrade DSM to the following builds or later (cert.cyber.gouv.fr):

  • 7.2.1-69057-13 on the 7.2.1 branch.
  • 7.2.2-72806-10 on the 7.2.2 branch.
  • 7.3.2-86009-5 on 7.3.
  • 7.4.1-90080-1 on 7.4.

SA-26:18 lists no mitigation other than the update (cert.cyber.gouv.fr), and securityonline.info states that no workarounds exist. As hardening, because most flaws need a valid account:

  • Review user accounts and LDAP or Active Directory links.
  • Restrict exposure of the DSM web interface.
  • Check logs for unexpected file changes.

Relatos divergentes

  • Severity and nature of CVE-2026-76954: securityonline.info calls it a critical SQL injection (CVSS 9.8) and reports that Viettel Cyber Security listed it as a pre-auth zero-click RCE. cert.cyber.gouv.fr only lists the CVE and says its details are unverified, because the SA-26:19 page was not retrieved. The 9.8 score and the RCE characterization therefore rest on a single news source and are not confirmed by the vendor page.
  • Authentication requirements: cert.cyber.gouv.fr says most flaws require an authenticated user and that the highest SA-26:18 score is 8.8. securityonline.info stresses remote, unauthenticated attackers. The two are compatible only if the pre-auth flaw sits in SA-26:19, which was not verified.
  • Exploitation status: neither source reports exploitation in the wild.

Linha do tempo

  1. securityonline.info ↗ · pub. 10/11/2026 14:01 · coletado 10/11 15:00

    Synology Patches 27 Flaws in DiskStation Manager Including Critical Pre-Auth SQL Injection

    ler a análise desta fonte

    Synology released urgent updates for Synology DiskStation Manager (DSM) to fix 27 security bugs across two reports. Led by a critical SQL injection flaw (CVE-2026-76954, CVSS 9.8), the bugs let remote attackers read or write files and crash NAS hosts. Because no workarounds exist, admins must install the latest DSM builds right away.

    Synology DiskStation Manager runs network storage hosts that hold backups and private files for firms and homes worldwide. Both the Synology-SA-26:19 advisory and the Synology-SA-26:18 bulletin confirm the high risk of these 27 bugs. In addition, Viettel Cyber Security researchers listed CVE-2026-76954 as a pre-auth zero-click remote code execution flaw.

  2. cert.cyber.gouv.fr ↗ · pub. 09/11/2026 21:00 · coletado 10/11 13:04 primeiro registro

    Synology DSM 7.2–7.4: 27 CVEs in two advisories, including arbitrary file read/write, DoS and SSRF flaws

    ler a análise desta fonte

    On 10 November 2026 Synology published two DSM advisories, Synology-SA-26:18 and Synology-SA-26:19, covering Synology DiskStation Manager (DSM) 7.2, 7.3 and 7.4. The CERT-FR bulletin lists 27 CVE identifiers and classes their effects as confidentiality breaches, security policy bypasses, remote denial of service and server-side request forgery (SSRF). According to the vendor, the flaws let an attacker read or write arbitrary files or trigger denial of service, and most of them require an authenticated user, so exposure depends on who holds an account on the NAS. The highest CVSS 3.1 score in SA-26:18 is 8.8, and the vendor's index page rates SA-26:19 Critical, but that advisory's detail page was not retrieved during research. Neither the article nor the vendor pages report exploitation in the wild, and the vendor lists no mitigation other than patching, so the urgency is rated high.

    Technical Details

    Synology's SA-26:18 covers DSM 7.3 and 7.4, lists 25 CVEs, and rates them Important with CVSS 3.1 scores from 4.3 to 8.8 (synology.com). The top-scored entries are authorization and path-handling flaws that need an authenticated user: CVE-2026-13672 in SSOAuth (user-controlled key, 8.8), CVE-2026-18792 in the Sharing API (path traversal, 8.8) and CVE-2026-74857 in the Auth API (missing authentication step, 8.8) (synology.com). Entries that do not need credentials are limited to denial of service or read access: CVE-2026-18633 in nfsd (uninitialized pointer, 7.5, DoS), CVE-2026-15198 in WebDAV (missing authentication, 6.5), CVE-2026-124993 in Security Advisor (incorrect authorization, file read, 5.3) and CVE-2026-85098 in synoscgi (reachable assertion, 5.3) (synology.com). The SSRF is CVE-2026-77738 in the Credential API, rated 4.3 and requiring an authenticated user (synology.com). CVE-2026-81584, a SQL injection in the User API rated 8.1, requires an attacker who controls a compromised LDAP or Active Directory server (synology.com). The CERT-FR list also includes CVE-2026-76954 and CVE-2026-85101, which are absent from SA-26:18; they are presumably in SA-26:19, whose detail page was not retrieved, so their details are unverified. The CERT-FR article gives no CVSS scores or prerequisites (cert.cyber.gouv.fr).

    Remediation

    Upgrade to DSM 7.2.1-69057-13 or later on the 7.2.1 branch and 7.2.2-72806-10 or later on the 7.2.2 branch (cert.cyber.gouv.fr), to 7.3.2-86009-5 or later on 7.3, and to 7.4.1-90080-1 or later on 7.4 (synology.com). The SA-26:18 advisory lists no mitigation other than the update (synology.com). Because most flaws need a valid account, review user accounts and LDAP or Active Directory links, restrict exposure of the DSM web interface, and check logs for unexpected file changes.