Synology DSM November 2026 Security Updates: Two Advisories, Four Branches

Synology DSM November 2026 security updates address two advisories published on 10 November. SA-26:19 fixes two flaws across DSM 7.2.1, 7.2.2, 7.3, and 7.4. SA-26:18 covers additional flaws in DSM 7.3 and 7.4 only.

The critical Auth API flaw, CVE-2026-76954, has a Synology CVSS 3.1 score of 9.8. Check the complete DSM build before choosing a patch, because the two advisories share fixed builds on 7.3 and 7.4 but have different affected branch lists.

Synology DSM November 2026: Which Builds Fix Each Advisory?

Synology marks both advisories resolved and lists no mitigation. Its fixed releases form a branch-specific checklist, not one universal DSM version.

These are Synology’s minimum fixed builds for the affected branches. Verify the full version and update suffix after installation, then check the advisory again for any revised release guidance.

SA-26:19: Auth API and rsync Require Separate Risk Decisions

CVE-2026-76954 is SQL injection in DSM’s Auth API, classified as CWE-89. Synology says a remote attacker can read or write arbitrary files and cause denial of service; its CVSS 3.1 vector requires neither privileges nor user interaction.

CVE-2026-85101 is an authentication bypass in rsync, classified as CWE-288. Synology says it can expose specific files, permit arbitrary file writes, and cause limited denial of service. Its CVSS 3.1 score is 8.6, with no privileges or user interaction in the published vector.

The advisory does not describe a complete exploit chain for either flaw. Synology provides CVSS 3.1 scores but no CVSS 4.0 scores in these advisories. Treat the Auth API and rsync findings as separate exposure questions, while using the same branch-specific fixed builds above.

SA-26:18: Important and Moderate DSM Findings

This advisory covers 25 more CVEs on DSM 7.3 and 7.4. Synology rates eight Important and 17 Moderate. The table keeps each CVE’s stated condition or affected component visible, because their prerequisites differ substantially.

Among the Important entries, SSOAuth, Sharing API, and Auth API require an authenticated user. CVE-2026-18596 requires valid user credentials, while CVE-2026-81584 requires control of a compromised LDAP or Active Directory server.

The moderate entries also vary: Webdav API, Security Advisor, and synoscgi have remote attacker conditions, whereas several others require authentication. CVE-2026-15201 involves an on-path attacker during support form submission; the three XSS entries involve user interaction.

How Should Owners Prioritize the November Patches?

Neither Synology advisory states that the newly disclosed flaws are being exploited. The CISA KEV catalog version dated 10 November 2026 did not list CVE-2026-76954 or CVE-2026-85101. That catalog status is a dated observation, not proof of safety.

Brandefense Blackhole recorded two Telegram posts naming CVE-2026-76954 during the 90-day window ending 12 November. It recorded one Telegram post and one dark chat entry naming CVE-2026-85101. These counts indicate discussion, not verified exploitation.

A GitHub search also found one public repository naming CVE-2026-76954. Its name alone does not establish a working proof of concept. Prioritize the exposed, unpatched Auth API and rsync surfaces by the vendor’s stated impacts and conditions.

How Should DSM Owners Apply the Updates?

Inventory every DSM instance and record its full build, including the update suffix. Map each instance to the applicable row above, schedule the fixed release, and verify the running build after the maintenance window.

• Inventory each DSM buildInclude the update suffix.
• Match its branchUse the SA-26:19 row and check whether SA-26:18 applies.
• Install the fixed releaseFollow Synology’s branch-specific target.
• Verify the running buildConfirm the final update suffix and service health.

Our patch management definition explains how to track rollout and verification. The vulnerability management guide provides a broader inventory and prioritization process.

Do not confuse this November set with Synology’s September SCGI and login logic vulnerabilities. Those are CVE-2026-13684 and CVE-2026-13639 under SA-26:13, with different earlier fixed builds. Check both advisories if a device has missed multiple update cycles.