CVE-2026-85101: High severity vulnerability
Published Nov 12, 2026
·Updated
An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.
Event History
Nov 12, 2026
CVE Published
via MITRE·03:40 AM
Data Sourced
via MITRE·03:40 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which DSM versions need to be updated?
DSM versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 are affected.
2
Does exploitation require authentication or user interaction?
No. The vulnerability is remotely exploitable without privileges or user interaction.
3
What could an attacker do after exploiting this issue?
An attacker could read specific files, write arbitrary files, and cause limited denial of service.