[VincaSec]

Synology published security advisory Synology-SA-26:19 for DiskStation Manager (DSM) on 10 November 2026 at 17:06:42 UTC+8, which is 11:06:42 Asia/Jerusalem (UTC+2). The advisory is revision 1, "Initial public release," and Synology last updated it at the same timestamp. Synology rates the advisory Critical and marks its status Resolved.

The advisory covers CVE-2026-76954 and CVE-2026-85101, closed by the same DSM builds:

• CVE-2026-76954, which Synology rates Critical (CVSS 3.1 9.8): "An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks."
  
• CVE-2026-85101, which Synology's advisory labels Important and scores CVSS 3.1 8.6: "An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks." Synology's CVE record lists that same 8.6 score as High.
  

https://www.rescana.com/post/synology-ds...-patch-now