Synology says a remote attacker can read or write arbitrary files and cause denial of service.The vendor rates it 9.8 Critical under CVSS 3.1. Its vector specifies network access, low attack complexity, no required privileges, and no user interaction. Synology published fixed releases for four DSM branches on November 10, 2026.
What it allows
How Does CVE-2026-76954 Affect DSM?
Synology identifies improper neutralization of special elements in an SQL command inside DSM's Auth API. That classification is SQL injection, or CWE-89. The advisory does not describe the exact processing path, so the input and query behavior remain unspecified.
The published CVSS vector indicates that an attacker needs neither an account nor another user's action. Synology says successful exploitation can read or write arbitrary files and cause denial of service. Its vector rates confidentiality, integrity, and availability impact as high.
Is CVE-2026-76954 Being Exploited?
The CISA KEV catalog version 2026.11.10 does not list CVE-2026-76954. This is a dated catalog fact, not a verdict about real-world exploitation. A public GitHub search in the source pack returned one repository named for this CVE; its code was not assessed.
Brandefense Blackhole counted two Telegram posts mentioning CVE-2026-76954 between August 14 and November 12, 2026. Mentions do not establish exploitation, but they show attention around the identifier. Defenders should prioritize the vendor's fix because the stated impact includes arbitrary file access.
Who is affected
Which DSM Releases Fix CVE-2026-76954?
Synology lists four affected DSM branches and a fixed release for each. Upgrade the running branch to its listed build or later, then confirm the installed version. The same advisory covers a separate rsync authentication bypass, CVE-2026-85101; the two IDs describe different flaws.
| DSM branch | Fixed release |
|---|---|
| DSM 7.4 | 7.4.1-90080-1 or later |
| DSM 7.3 | 7.3.2-86009-5 or later |
| DSM 7.2.2 | 7.2.2-72806-10 or later |
| DSM 7.2.1 | 7.2.1-69057-13 or later |
Synology lists no separate mitigation in SA-26:19. Our practical recommendation is to inventory reachable DSM instances and schedule the branch-matched update first. See the existing Synology DSM vulnerability profile for earlier, distinct DSM flaws.
Timeline
- 2026-11-10
Synology published advisory SA-26:19, identified the Auth API SQL injection, and listed fixed DSM releases for four branches.
- 2026-11-12
NVD published CVE-2026-76954 with Synology's CVSS 3.1 score and CWE-89 classification.
What to do
-
Apply the branch-matched DSM update
Upgrade DSM 7.4 to 7.4.1-90080-1, 7.3 to 7.3.2-86009-5, 7.2.2 to 7.2.2-72806-10, or 7.2.1 to 7.2.1-69057-13, or later.
-
Confirm versions after maintenance
Inventory DSM systems, verify the running branch and installed build, and confirm each update completed. Synology lists no separate mitigation in the advisory.
-
Review exposed systems
Brandefense recommends prioritizing DSM systems reachable from untrusted networks. Review relevant authentication, database, and file activity for unexplained changes while patching.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-76954?
It is a critical SQL injection vulnerability in Synology DSM's Auth API. Synology says remote attackers can read or write arbitrary files and cause denial of service.
Does CVE-2026-76954 require authentication?
Synology's CVSS 3.1 vector lists PR:N and UI:N. It describes a network attack requiring no privileges or user interaction.
Which DSM versions fix CVE-2026-76954?
Synology lists 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10, and 7.2.1-69057-13 as fixed releases for their respective branches.
Is CVE-2026-76954 the same as CVE-2026-85101?
No. The same Synology advisory covers both, but CVE-2026-85101 is a separate rsync authentication bypass. CVE-2026-76954 affects the Auth API.
Sources
- Synology-SA-26:19 DSMSynology
- CVE-2026-76954 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
