Quick Answer
Synology NAS owners should install the latest DSM build immediately. Synology rated advisory SA-26:19 Critical on November 10, 2026, because two remotely exploitable flaws can allow file access, file modification, or denial-of-service attacks. No workaround is listed. Back up essential data, update DSM from the administrator interface, and confirm that the installed build meets Synology’s fixed-version threshold.
Key Takeaways
- Synology rated DSM advisory SA-26:19 as Critical on November 10, 2026.
- CVE-2026-76954 has a CVSS 3.1 base score of 9.8 and affects DSM’s Auth API.
- CVE-2026-85101 has a CVSS 3.1 score of 8.6 and involves rsync authentication bypass.
- Synology lists DSM updates as the only mitigation for both vulnerabilities.
- Fixed builds begin with DSM 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, or 7.4.1-90080-1.
What makes the Synology DSM security update urgent?
The Synology DSM security update is urgent because the company classified advisory Synology-SA-26:19 as Critical on November 10, 2026. The advisory covers 2 flaws that can be exploited remotely and can expose stored data to unauthorized reading or modification. Synology’s security advisory identifies DSM updates as the only mitigation.
The most serious issue, CVE-2026-76954, is an SQL-injection flaw in DSM’s Auth API with a CVSS 3.1 base score of 9.8 out of 10. Synology’s CVSS vector specifies network access, low attack complexity, no privileges required, and no user interaction. Those conditions matter because an attacker does not need an existing DSM account or a person at the NAS to approve an action before attempting exploitation.
CVE-2026-76954 can allow remote attackers to read or write arbitrary files and conduct denial-of-service attacks, according to Synology. A successful file-write attack creates a serious integrity risk because a NAS often holds documents, backups, media libraries, and shared household or business files in one place. Owners should treat the update as a data-protection task, not a routine optional maintenance item.
Which DSM vulnerabilities does Synology-SA-26:19 fix?
Synology-SA-26:19 fixes 2 vulnerabilities: CVE-2026-76954 in DSM’s Auth API and CVE-2026-85101 in rsync authentication. Both flaws can be reached remotely, but their stated effects and severity scores differ. The table below separates the risks so NAS owners can understand why installing the current DSM build matters.
| Vulnerability | Component | CVSS 3.1 score | Stated impact |
|---|---|---|---|
| CVE-2026-76954 | DSM Auth API | 9.8 | Read or write arbitrary files and conduct denial-of-service attacks |
| CVE-2026-85101 | rsync authentication | 8.6 | Read specific files, write arbitrary files, and conduct limited denial-of-service attacks |
CVE-2026-76954 is the higher-severity flaw because its score is 9.8 and Synology describes broad arbitrary file access capabilities. SQL injection occurs when an application handles database-related input in an unsafe way, potentially letting an attacker alter the intended request. The practical concern is not the technical label alone. File access or modification can affect the confidentiality and reliability of material stored on the NAS.
CVE-2026-85101 is an rsync authentication-bypass flaw with a score of 8.6. Synology says the vulnerability can let remote attackers read specific files, write arbitrary files, and carry out limited denial-of-service attacks. Users who rely on network file synchronization should not assume that a login screen alone eliminates the risk. Update the DSM branch your device uses, then review whether remote services remain necessary for your setup.
How can the DSM flaws affect files on a Synology NAS?
The DSM flaws can affect both file privacy and file integrity because Synology says the vulnerabilities can allow attackers to read files, write arbitrary files, or disrupt service. Reading files can expose sensitive information, while unauthorized writing can alter or damage the stored material. A denial-of-service attack can also make the NAS or affected service unavailable when you need access to backups or shared folders.
The risk is especially important for NAS devices that store centralized copies of personal records, creative projects, business documents, or device backups. A NAS can reduce the inconvenience of scattered storage, but centralization also means one exposed service can place more than one category of data at risk. The earlier NAS attack concerns involving Plex servers illustrate why storage appliances need the same patch discipline as computers and phones.
The Synology advisory does not say that every unpatched NAS has been compromised. The advisory does say that remote attackers can exploit the listed flaws under the stated conditions, and Synology provides no alternative mitigation. The sensible response is to update first, preserve a separate backup of important data, and avoid treating the absence of suspicious activity as proof that the device is protected.
Which DSM versions contain the security fixes?
The Synology DSM security update is fixed in 4 version thresholds, depending on the DSM branch installed on the NAS. Synology lists DSM 7.2.1-69057-13, DSM 7.2.2-72806-10, DSM 7.3.2-86009-5, and DSM 7.4.1-90080-1 as the corrected builds or later versions. A version number below the relevant threshold remains outside the listed fix level.
- DSM 7.2.1 requires build 69057-13 or later.
- DSM 7.2.2 requires build 72806-10 or later.
- DSM 7.3.2 requires build 86009-5 or later.
- DSM 7.4.1 requires build 90080-1 or later.
Korea’s Internet & Security Agency repeated the same fixed-version thresholds in an update recommendation issued November 12, 2026. KISA’s update advisory also recommends affected Synology users install the available update. Independent confirmation from a national cybersecurity agency reinforces that the correct action is to patch rather than wait for a configuration workaround.
A later build on the same DSM branch meets Synology’s stated threshold. NAS owners should check the complete build number rather than relying only on the major DSM number, because “DSM 7” alone does not establish whether the security fix is present. Record the installed version before updating if you manage more than one device.
How should you install the Synology DSM security update safely?
The Synology DSM security update should be installed after you create or verify a separate backup of essential files. Updating DSM is the only mitigation Synology lists, but any system update can involve a restart or a temporary interruption to services. A current backup gives you a recovery option if an unrelated hardware, power, or configuration problem occurs during maintenance.
- Back up essential NAS data to a separate location before starting the DSM update.
- Sign in to the Synology NAS administrator interface and check the installed DSM version and build number.
- Install the available DSM update that reaches or exceeds Synology’s fixed threshold for the current branch.
- Allow the NAS to complete the update and restart without interrupting power or network access.
- Confirm that the installed DSM build matches the fixed version or a later build after the NAS returns to service.
- Review remote access and file-sync services after updating, and disable services that are not required.
Synology’s advisory does not provide a configuration change that replaces the update. The practical response is therefore to install the corrected build rather than search for a temporary setting. Users who cannot complete the update, who see an update failure, or who depend on the NAS for critical work should stop and contact Synology support or their managed IT provider rather than repeatedly interrupting the installation.
Security updates are most effective when they are part of a broader maintenance process. Readers who want a general explanation of the controls involved can review core cybersecurity practices, including patching, backups, and access protection. Those measures reduce risk, but they do not substitute for applying a vendor’s available security fix.
What should Synology NAS owners check after updating DSM?
Synology NAS owners should verify the installed build number after updating DSM, because the version check confirms that the device reached the corrected release. Check that the current version meets or exceeds the threshold for the installed branch: 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, or 7.4.1-90080-1. A successful restart alone does not establish that the correct build was installed.
Synology NAS owners should also confirm that essential shares, backup jobs, and synchronization tasks operate normally after the update. The reason is practical: security maintenance may require a restart, and a NAS often supports automated tasks that users do not manually monitor each day. Verify normal access from the devices that depend on the NAS, especially if the system stores backup copies that you may need during a separate computer failure.
Synology NAS owners should review any remote access or rsync use after applying the patch. The advisory identifies rsync authentication as part of CVE-2026-85101, so services exposed beyond the local network deserve particular attention. Do not make broad configuration changes unless you understand their effect on backups and sharing. Contact the service provider or an IT professional if turning off a service could disrupt an important workflow.
Do you need to update a Synology NAS that is only used at home?
A home Synology NAS still needs the DSM security update because the listed vulnerabilities involve remote attack paths, not only large business environments. The data stored on a home NAS can include tax records, family photos, computer backups, and personal documents. Synology’s Critical rating and lack of a listed mitigation apply to affected users regardless of whether the device is used for home storage or work.
A home NAS may have less complex administration than an office server, but simplicity does not remove the need to patch. The most important question is whether the installed DSM build meets Synology’s corrected version threshold. Install the update, keep a separate backup, and make sure only necessary services remain enabled after the update completes.
Storage-device incidents can also create broader account and privacy risks when exposed files contain personal information. Reports such as the DreamHost file manager breach show why stored credentials and sensitive files deserve careful protection. A DSM update will not change the contents of old files, so review access practices separately if the NAS holds passwords, identity documents, or confidential records.
FAQ
Is the Synology DSM update required for CVE-2026-76954?
Yes, the Synology DSM update is the only mitigation listed for CVE-2026-76954. Synology says the Auth API SQL-injection flaw can let remote attackers read or write arbitrary files and conduct denial-of-service attacks.
What DSM version fixes CVE-2026-85101?
Synology lists DSM 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 or later as fixed versions, depending on the DSM branch. Confirm the complete build number after the update finishes.
Can attackers access a Synology NAS without an account?
Yes, CVE-2026-76954 has a CVSS vector that specifies no privileges required and no user interaction. Synology also lists network access and low attack complexity for the vulnerability.
Should you back up a Synology NAS before updating DSM?
Yes, back up essential NAS data before installing the DSM update. The security update is necessary, but a separate backup protects important files if an unrelated power, hardware, or update problem interrupts maintenance.
Does the Synology advisory list a workaround besides updating?
No, Synology lists no mitigation other than updating DSM. Install a fixed build as soon as possible, then verify the version number and normal NAS operation.