CVE-2026-19048: High severity vulnerability

Published Nov 12, 2026

Updated

An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.

Event History

Nov 12, 2026

CVE Published

via MITRE·03:33 AM

Data Sourced

via MITRE·03:33 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote authenticated user can exploit it. The provided data does not indicate that unauthenticated attackers can do so.

Which DSM versions need remediation?

DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected. Updating to the applicable fixed release addresses the issue.

What impact could exploitation have?

An attacker may write arbitrary files and cause denial of service. The supplied severity vector indicates impacts to integrity and availability, with no stated confidentiality impact.

CVE-2026-19048: High severity vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

Which DSM versions need remediation?

What impact could exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which DSM versions need remediation?

What impact could exploitation have?