CVE-2026-76954: SQL Injection
Published Nov 12, 2026
·Updated
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Event History
Nov 12, 2026
CVE Published
via MITRE·03:41 AM
Data Sourced
via MITRE·03:41 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which DSM releases contain fixes for this issue?
Fixed versions are DSM 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. Releases before those versions are affected.
2
Does exploitation require authentication or user interaction?
No. The vulnerability is remotely exploitable with no privileges and no user interaction required.
3
What impact can a successful attacker have?
A remote attacker can read or write arbitrary files and cause denial of service.