CVE-2026-86343: CRLF Injection

Published Nov 12, 2026

Updated

An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks.

Event History

Nov 12, 2026

CVE Published

via MITRE·03:34 AM

Data Sourced

via MITRE·03:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must be remote, authenticated to DSM, and have administrator privileges. The affected component is the DSM SNMP API.

Which DSM versions are affected?

DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected.

What could an attacker do after exploiting it?

An authenticated administrator could read or write arbitrary files and cause denial-of-service conditions.

CVE-2026-86343: CRLF Injection

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which DSM versions are affected?

What could an attacker do after exploiting it?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which DSM versions are affected?

What could an attacker do after exploiting it?