External risk intelligence

Synology DSM Auth API SQL Injection Allows Arbitrary File Read Write and DoS

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-76954

The vulnerability resides in the Auth API of Synology DiskStation Manager (DSM). DSM is an operating system for network-attached storage devices that is frequently exposed to the public internet to provide remote access, file sharing, and management services. As an authentication-related interface for a device commonly deployed as an internet-facing gateway, it is highly likely to be reachable from the public internet.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Synology's DiskStation Manager, specifically within its authentication API, could allow unauthorized access to sensitive files or disrupt services. This issue, impacting systems that might be externally accessible for remote management, presents a significant risk if left unaddressed.

SQL injection allows unauthorized file access or disruption.
Critical authentication flaw impacts internet-facing devices.
Confirm relevance and exposure to Synology systems.

Attack Path

How an attacker could exploit the issue

An attacker can reach the Auth API in Synology DiskStation Manager (DSM) from the internet. By sending specially crafted requests, they can exploit an SQL injection vulnerability to read or write any file on the system or cause a denial-of-service.

No user interaction required.
Specially crafted requests to Auth API.
Arbitrary file access and denial-of-service.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in Synology DSM's Auth API could allow remote attackers to read or write arbitrary files, and disrupt service availability. This exposure is possible because the Auth API is often exposed externally and is accessible over the network without requiring user interaction or prior authentication.

Sensitive files could be read or modified.
Network access to Auth API.
Service disruption and unauthorized file access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Synology DiskStation Manager (DSM) owners and infrastructure teams are likely responsible for addressing this vulnerability in the Auth API. The immediate first step is to identify all instances of DSM, determine their internet reachability and business criticality, and then assign ownership for remediation planning.

Assign DSM application owners for remediation.
Verify DSM instances and their exposure.
Plan and execute mitigation or patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Synology DiskStation Manager (DSM)?

Synology DiskStation Manager is the core operating system powering Synology network-attached storage (NAS) devices. It provides a web-based interface for managing files, running backup services, and hosting applications. Because it manages storage and remote access, it acts as a central hub for personal or business data, often serving as a gateway for remote file retrieval and administration.

What does CVE-2026-76954 mean by improper neutralization of SQL special elements?

This vulnerability is classified as CWE-89, or SQL Injection. It occurs when the Auth API fails to properly filter or sanitize user-supplied input before using it in a database query. By sending malicious characters within a request, an attacker can manipulate that query to access unauthorized information, modify sensitive files, or cause the service to crash.

How does an attacker trigger this vulnerability in the Auth API?

An attacker triggers this by sending a specially crafted request directly to the Auth API endpoint. Because the vulnerability exists within the authentication process itself, no legitimate credentials or user interaction are required to initiate the attack. If a request does not contain the specifically formatted SQL commands designed to exploit this flaw, the API will function normally.

Why does Halo Surface Signal categorize this as an external risk?

Halo Surface Signal flags this as an external risk because the affected Auth API is frequently reachable from the public internet. Since DSM devices are often configured to allow remote management or cloud-based file access, they sit at the network edge. This placement makes the authentication interface discoverable and accessible to anyone on the internet, increasing the likelihood of unauthorized exploitation.

Is my Synology system affected, and what should I do first?

You should check if your device is running a version of DSM earlier than the patched releases listed in the advisory. Your first step is to inventory all Synology devices in your environment to confirm their current version and determine if they are exposed to the internet. Prioritize updating internet-facing devices immediately, as these are the most accessible targets for remote attackers.

References

www.synology.com/en-global/security/advisory/Synology_SA_26_19

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.