Synology says a remote attacker can read specific files, write arbitrary files, and cause limited denial of service. The flaw affects four DSM branches before their respective fixed builds.Synology rates this individual flaw Important with a CVSS 3.1 score of 8.6. Its SA-26:19 advisory and affected-product table carry a Critical rating; the advisory also covers a separate, higher-scoring Auth API flaw. The rsync issue is distinct from that SQL injection.
What it allows
How Does CVE-2026-85101 Bypass Authentication?
Synology classifies the rsync flaw as authentication bypass through an alternate path or channel, or CWE-288. That identifies the weakness category, but the advisory does not describe a request path or the internal authentication logic. A precise attack sequence would go beyond the published record.
The published CVSS vector lists network access, low complexity, no required privileges, and no user interaction. Synology states the resulting access can expose specific files and permit arbitrary file writes. It also describes the denial-of-service impact as limited. The file-write effect makes integrity a priority even though the stated file-read scope is narrower.
What Does the Current Risk Evidence Show?
CISA KEV catalog version 2026.11.10 does not list CVE-2026-85101. That dated catalog status does not settle whether the flaw has been used elsewhere. The structured exploitation status is therefore unknown.
Brandefense Blackhole counted one Telegram result mentioning this CVE between August 14 and November 12, 2026. The supplied count also classifies one result as dark chat; these figures should not be added together as separate events. A mention is attention to the identifier, not evidence of a successful attack.
Synology's 8.6 score and remote access vector support prompt patching of reachable DSM systems. For background, see our profile of earlier, distinct Synology DSM flaws. Those CVEs are unrelated to CVE-2026-85101 and are not included in SA-26:19.
Who is affected
Which DSM Builds Fix CVE-2026-85101?
Synology provides a fixed build for every affected DSM branch in SA-26:19. Administrators should match their installed branch to the corresponding release, then upgrade to that build or later. The advisory lists no separate mitigation.
| DSM branch | Fixed release |
|---|---|
| DSM 7.4 | 7.4.1-90080-1 or later |
| DSM 7.3 | 7.3.2-86009-5 or later |
| DSM 7.2.2 | 7.2.2-72806-10 or later |
| DSM 7.2.1 | 7.2.1-69057-13 or later |
The same releases also address CVE-2026-76954, a separate Auth API SQL injection rated 9.8 by Synology. Do not transfer that CVE's file-read scope or score to the rsync vulnerability. Use the CVSS score explanation when comparing their published vectors.
What Should Defenders Check?
Our recommendation is to inventory DSM systems, confirm their running branches, and prioritize systems reachable from untrusted networks. After updating, verify the installed build and review relevant file and rsync activity for unexplained changes. This is defensive guidance drawn from the remote vector and stated file impacts, not a vendor-supplied detection rule.
Record the before and after build numbers in your patch management process. Synology's branch-specific table is the source for determining whether a system has crossed the fixed-build threshold.
- Identify the DSM branchRecord the installed build before maintenance.
- Upgrade to the listed releaseUse the branch-matched fixed build or later.
- Verify and reviewConfirm the new build and examine relevant file and rsync activity.
Timeline
- 2026-11-10
Synology published SA-26:19 and listed four fixed DSM releases for CVE-2026-85101.
- 2026-11-12
NVD published the CVE record using Synology's CVSS 3.1 score and CWE-288 classification.
What to do
-
Apply the correct DSM release
Upgrade DSM 7.4 to 7.4.1-90080-1, 7.3 to 7.3.2-86009-5, 7.2.2 to 7.2.2-72806-10, or 7.2.1 to 7.2.1-69057-13, or later.
-
Verify the installed build
Inventory each DSM system and confirm its installed release matches the fixed version for its branch after maintenance.
-
Review reachable systems
Brandefense recommends prioritizing DSM systems reachable from untrusted networks and reviewing relevant file and rsync activity for unexplained changes.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-85101?
It is an authentication bypass in Synology DSM's rsync component. Synology says remote attackers may read specific files, write arbitrary files, and cause limited denial of service.
Does CVE-2026-85101 require an account?
Synology's CVSS 3.1 vector lists PR:N and UI:N, indicating no required privileges or user interaction.
Which DSM releases fix CVE-2026-85101?
Synology lists 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10, and 7.2.1-69057-13 for their respective branches.
Why does Synology's advisory say Critical?
SA-26:19 covers two flaws. Synology rates this rsync flaw Important at 8.6, while the separate Auth API SQL injection scores 9.8 Critical.
Sources
- Synology-SA-26:19 DSMSynology
- CVE-2026-85101 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
