SecurityOnlineDo Son
Synology patches 27 flaws in DiskStation Manager
Part of the Synology story · since 2 Nov
- Mon 2 Nov, 02:30 UTC. SecurityOnline, first report. Ransomware targets unpatched Synology NAS devices.
- Tue 3 Nov, 03:30 UTC. SANS ISC, its first report on the story. Stormcast covers crypto attacks and flaws in network security tools.
- Tue 3 Nov, 08:30 UTC. The Hacker News, its first report on the story. Synology warns ransomware operators are targeting outdated NAS devices.
- Tue 3 Nov, 17:30 UTC. Security Affairs, its first report on the story. Synology warns ransomware operators are targeting outdated NAS devices.
- Fri 6 Nov, 15:30 UTC. SecurityWeek, its first report on the story. Attackers weaponise SAP flaws within days as AI bills soar.
- Tue 10 Nov, 19:00 UTC. SecurityOnline. Synology patches 27 flaws in DiskStation Manager. This article, 6th of 6.
Synology has released urgent patches for DiskStation Manager (DSM) to fix 27 security defects across two advisory reports. At the top of the list is CVE-2026-76954, a critical pre-auth SQL injection in the Auth API (CWE-89) that could allow remote attackers to read or write arbitrary files and trigger denial-of-service conditions (CVSS 9.8). The vendor states there are no workarounds and that users must update to the latest DSM builds.
The affected branches include DSM 7.4, 7.3, 7.2.2, and 7.2.1, with specific patches listed as DSM 7.4.1-90080-1 for DSM 7.4 and DSM 7.3.2-86009-5 for DSM 7.3, plus DSM 7.2.2-72806-10 and DSM 7.2.1-69057-13 for older branches.
The bulk of the flaws arise from two advisory reports (SA-26:19 and SA-26:18). SA-26:19 documents two unauthenticated network flaws, including CVE-2026-76954 (SQL injection in the Auth API) and CVE-2026-85101 (CWE-288 login bypass in rsync), both of which could enable reading or writing arbitrary files and limited denial-of-service.
SA-26:18 covers 25 additional important-to-moderate bugs across internal DSM tools, with three 8.8 CVSS flaws affecting SSOAuth (CVE-2026-13672), the Sharing API (CVE-2026-18792), and the Auth API (CVE-2026-74857), permitting logged-in users to read or write arbitrary files and crash services. Other notes include an 8.1 group (e.g., OTP login bypass CVE-2026-18596) and an SQL injection via rogue LDAP servers (CVE-2026-81584). Synology advises updating to the latest DSM builds as there are no mitigations.
How the story developed
6 articles from 5 outlets since 2 Nov. Picked up again today after 4 days quiet. This was the 6th report, 9 days after the first.
- Mon 2 Nov, 02:30 UTC. SecurityOnline, first report. Ransomware targets unpatched Synology NAS devices.
- Tue 3 Nov, 03:30 UTC. SANS ISC, its first report on the story. Stormcast covers crypto attacks and flaws in network security tools.
- Tue 3 Nov, 08:30 UTC. The Hacker News, its first report on the story. Synology warns ransomware operators are targeting outdated NAS devices.
- Tue 3 Nov, 17:30 UTC. Security Affairs, its first report on the story. Synology warns ransomware operators are targeting outdated NAS devices.
- Fri 6 Nov, 15:30 UTC. SecurityWeek, its first report on the story. Attackers weaponise SAP flaws within days as AI bills soar.
- Tue 10 Nov, 19:00 UTC. SecurityOnline. Synology patches 27 flaws in DiskStation Manager. This article, 6th of 6.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 6 articles as a listHide the list
- Mon 2 NovDay 01
- Ransomware targets unpatched Synology NAS devices02:30 · SecurityOnline · First report
- Tue 3 NovDay 13
- Synology warns ransomware operators are targeting outdated NAS devices08:30 · The Hacker News
- Synology warns ransomware operators are targeting outdated NAS devices17:30 · Security Affairs
Quiet for 3 days
Fri 6 NovDay 41- Attackers weaponise SAP flaws within days as AI bills soar15:30 · SecurityWeek · Picked up again
Quiet for 4 days
Tue 10 NovDay 81- Synology patches 27 flaws in DiskStation Manager19:00 · SecurityOnline · Picked up again · This article, 6th of 6