A security update has been released to address several vulnerabilities in Synology products, particularly DiskStation Manager (DSM).
The vulnerabilities addressed include an SQL injection vulnerability (CVE-2026-76954, CVE-2026-81584), a privilege escalation vulnerability that is bypassed via user-controlled keys (CVE-2026-13672), Path traversal vulnerabilities (CVE-2026-18792), a vulnerability involving the omission of a required step in the authentication process (CVE-2026-74857), and vulnerabilities that allow authentication bypass via alternative paths or channels (CVE-2026-85101, CVE-2026-18596), link tracking vulnerability (CVE-2026-19048), uninitialized pointer access vulnerability (CVE-2026-18633), and operating system command injection vulnerability (CVE-2026-75785).
Affected Versions include those affected by CVE-2026-13672, CVE-2026-18596, CVE-2026-18633, CVE-2026-18792, CVE-2026-19048, CVE-2026-74857, CVE-2026-75785, CVE-2026-81584: versions prior to 7.3.2-86009-5 and prior to 7.4.1-90080-1.
For CVE-2026-76954 and CVE-2026-85101, versions prior to 7.2.1-69057-13; versions prior to 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 are affected.
Synology recommends updating to the latest version with Vulnerability Patches, as outlined in the reference sites. – The reference sites are Synology-SA-26:18 DSM and Synology-SA-26:19 DSM.
