Multiple security vulnerabilities have been identified in DiskStation Manager, affecting versions 7.3 and 7.2.2 as stated, with additional flaws reported across the product. The issues include critical pre-authentication SQL injection, authorization bypass, path traversal, authentication bypass, link following, and other high-severity defects. No active exploitation is confirmed, but the flaws can allow remote attackers to perform unauthorized operations, access or modify files, and disrupt services on network storage hosts.
CVE-2026-76954 (CVSS 9.8 — Critical): SQL injection in the Auth API. It allows unauthenticated remote attackers to read or write arbitrary files and conduct denial-of-service attacks.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in DiskStation Manager, affecting versions 7.3 and 7.2.2 as stated, with additional flaws reported across the product. The issues include critical pre-authentication SQL injection, authorization bypass, path traversal, authentication bypass, link following, and other high-severity defects. No active exploitation is confirmed, but the flaws can allow remote attackers to perform unauthorized operations, access or modify files, and disrupt services on network storage hosts.
CVE-2026-76954 (CVSS 9.8 — Critical): SQL injection in the Auth API. It allows unauthenticated remote attackers to read or write arbitrary files and conduct denial-of-service attacks.[emaillocker id="1283"]
CVE-2026-13672 (CVSS 8.8 — High): Authorization bypass through user-controlled key in SSOAuth. It allows logged-in users to read or write arbitrary files and crash services.
CVE-2026-18792 (CVSS 8.8 — High): Path traversal in the Sharing API. It allows logged-in users to read or write arbitrary files and crash services.
CVE-2026-74857 (CVSS 8.8 — High): Missing critical step in authentication in the Auth API. It allows logged-in users to read or write arbitrary files and crash services.
CVE-2026-85101 (CVSS 8.6 — High): Authentication bypass using an alternate path or channel in rsync. It allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.
CVE-2026-18596 (CVSS 8.1 — High): Authentication bypass using an alternate path or channel in one-time password login. It allows attackers to bypass login controls and access protected functionality.
CVE-2026-19048 (CVSS 8.1 — High): Link following in the thumbnail component. It allows attackers to follow symbolic links and access files outside the intended location.
CVE-2026-81584 (CVSS 8.1 — High): SQL injection in the User API through malicious LDAP responses. It allows attackers to inject SQL commands through malicious LDAP responses.
CVE-2026-18633 (CVSS 7.5 — High): Pointer crash in the NFS service. It allows attackers to cause a denial of service by triggering a crash.
CVE-2026-75785 (CVSS 7.2 — High): Command injection in the VPN API. It allows attackers to execute unintended commands on the host through crafted input.
CVE-2026-15198 (CVSS 6.5 — Medium): Missing login checks in WebDAV. It allows attackers to access WebDAV functionality without proper authentication.
These vulnerabilities collectively present a severe risk to organizations and home users relying on network storage hosts for backups and private files. The most exposed systems are those with externally reachable management interfaces or weak access controls. Administrators should treat the affected storage systems as urgent security priorities.
We recommend you to update Synology DiskStation Manager to version 7.4.1-90080-1, 7.3.2-86009-5, 7.2.2-72806-10, or 7.2.1-69057-13 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]