CVE-2026-81584: Synology DiskStation Manager (DSM) vulnerability
Synology · DiskStation Manager (DSM)
Fixed in 7.3.2-86009-5 · Affected: Synology DiskStation Manager (DSM) before 7.3.2-86009-5 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 47% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files and conduct denial-of-service attacks.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- SQL Injection
- Vendor
- Synology
- Published
- November 2026
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 10 Nov.
- Synology patches 27 flaws in DiskStation ManagerSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.