Synology Patches Two Remote File Access Flaws in DSM
Synology released DiskStation Manager updates on 10 November for two vulnerabilities that let remote attackers read or write files on affected NAS devices. One is a SQL injection flaw in the DSM authentication API that can expose arbitrary files and disrupt service. The other is an authentication bypass in rsync that allows reads of specific files, arbitrary writes and limited denial of service. Synology provides fixed builds for four DSM branches and lists no mitigation in the advisory. CVE-2026-76954 · CVE-2026-85101 · Synology advisory
Match the installed DSM branch
For DSM 7.4, install 7.4.1-90080-1 or later. The minimum builds are 7.3.2-86009-5 for DSM 7.3, 7.2.2-72806-10 for DSM 7.2.2 and 7.2.1-69057-13 for DSM 7.2.1. Check the entire build number, including the final update suffix. If the NAS does not offer the update automatically, use Synology’s download centre for the exact model and check the required upgrade path. DSM build table · Synology Download Center
The fixed builds are for the DSM operating system, so upgrading the Plex package does not install them. After the DSM update, verify the build in Control Panel and check that backups and replication still run as expected. BlackTree’s Synology Plex coverage
Review which services were reachable
Prioritise NAS devices with DSM or rsync reachable from outside the management network. Remove unnecessary exposure while arranging the update. The advisory does not report exploitation. If a vulnerable NAS was reachable, use available access and file logs to investigate unexpected connections or changes before treating the patch as the end of the review. Synology advisory
