CVE-2026-76954 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-76954 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-76954 is a critical SQL injection flaw in Synology DiskStation Manager (DSM) Auth API affecting versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. A remote attacker can abuse improper SQL input handling to read or write arbitrary files and potentially trigger denial of service. Even though there is no known exploitation in the wild and it is not in CISA KEV, the severity is CRITICAL (CVSS 9.8), so small teams should treat this as an urgent patch-and-verify event.

If your environment exposes DSM or any Auth API-backed service to the internet, assume elevated risk. If you cannot patch immediately, isolate the system and restrict access now.

Immediate Action

  • Patch DSM immediately to one of the fixed builds: 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, or 7.4.1-90080-1 or later.
  • Restrict exposure: remove public internet access to DSM/Auth API, or place it behind VPN, firewall allowlists, or zero-trust access controls.
  • Disable or limit remote admin access until patched; block unnecessary ports at the edge and on the host.
  • Back up critical data and configs before upgrading, then verify the backup is restorable.
  • Review logs for suspicious requests to Auth API endpoints and unusual file access, errors, or service restarts.
  • Vendor advisory: see Synology security advisory / release notes for the official fix details.

Affected Versions

  • DSM < 7.2.1-69057-13 vulnerable; upgrade to 7.2.1-69057-13+
  • DSM < 7.2.2-72806-10 vulnerable; upgrade to 7.2.2-72806-10+
  • DSM < 7.3.2-86009-5 vulnerable; upgrade to 7.3.2-86009-5+
  • DSM < 7.4.1-90080-1 vulnerable; upgrade to 7.4.1-90080-1+

Safe versions: any build at or above the fixed version for your release line. If you are unsure which line you run, check the DSM version in the admin UI or via the system info page.

Resolution Guide

For DSM: apply the vendor update through the DSM control panel or package update workflow. If you manage multiple devices, stage the patch on one unit first, then roll out broadly.

# Check DSM version from shell if available
cat /etc.defaults/VERSION
uname -a

# Example: confirm the installed build
grep -E 'productversion|buildnumber' /etc.defaults/VERSION

For app teams that proxy or integrate with DSM Auth API: there is no npm/pip/Maven dependency to upgrade for this CVE, but you should harden any code that sends user-controlled input to SQL-like query builders or API parameters.

# JavaScript: avoid string concatenation in SQL queries
# BAD
const sql = `SELECT * FROM users WHERE name = '${name}'`;

# GOOD
const sql = 'SELECT * FROM users WHERE name = ?';
db.execute(sql, [name]);

# Python: parameterize queries
# BAD
cursor.execute(f"SELECT * FROM users WHERE name = '{name}'")

# GOOD
cursor.execute("SELECT * FROM users WHERE name = %s", (name,))

# Java / JDBC
PreparedStatement ps = conn.prepareStatement(
  "SELECT * FROM users WHERE name = ?"
);
ps.setString(1, name);

Linux package checks: if DSM is running in a VM or appliance management layer, ensure the host is patched and network-restricted.

# Debian/Ubuntu host hardening example
sudo apt update
sudo apt upgrade -y

# RHEL/CentOS/Rocky/Alma
sudo yum update -y

Docker guidance: if you run a DSM-related management container or reverse proxy in front of DSM, pin to a known-good image and rebuild after patching.

# Example placeholder: replace with your actual image tag
docker pull your-registry/your-image:TODO_FIXED_TAG
docker compose up -d --force-recreate

Config hardening:

# Example reverse proxy controls
# - Allow only VPN or admin subnet
# - Disable public exposure
# - Rate-limit auth endpoints
# - Block suspicious query patterns at WAF/proxy

Detection & Verification

Check whether you are vulnerable:

  • Confirm DSM build number against the affected list above.
  • Search logs for repeated Auth API requests, 500 errors, unexpected file reads/writes, or service crashes.
  • Use your asset inventory to find any DSM systems exposed to the internet.
# Quick version verification
cat /etc.defaults/VERSION

# Look for Auth API-related activity in logs
grep -RniE 'auth|sql|error|exception|denied|500' /var/log/ 2>/dev/null | head -n 50

Verify the fix:

# Re-check build number after patching
cat /etc.defaults/VERSION

# Confirm the version is at or above the fixed build
# 7.2.1-69057-13+
# 7.2.2-72806-10+
# 7.3.2-86009-5+
# 7.4.1-90080-1+

If you have an external scanner or CMDB, mark the device compliant only after the build number matches the fixed release and the service is reachable only from approved networks.

Risk and Impact

This flaw can let a remote attacker manipulate file access through the Auth API, which raises the risk from data exposure to full service disruption. For a solo developer or small team, the blast radius can include backups, shared project files, credentials stored on the device, and downtime for any service hosted on or behind the NAS. Because the issue is remotely reachable and critical, exposure on the public internet should be treated as an emergency.

Keep reading