Synology DiskStation Manager: Authentication bypass in rsync (CVE-2026-85101)
Synology DiskStation Manager (DSM) contains an authentication bypass vulnerability in its rsync implementation that allows remote attackers to read or write arbitrary files and trigger a denial-of-service.
CVE search metadata
CVE search record: CVE-2026-85101. Severity: high. CVSS: 8.6. KEV: no. Product: DiskStation Manager (DSM < 7.2.1-69057-13, < 7.2.2-72806-10, < 7.3.2-86009-5, < 7.4.1-90080-1). Brief: Synology DiskStation Manager: Authentication bypass in rsync (CVE-2026-85101). Brief link: https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-auth-bypass-cve-2026-85101/
Triage facts
Revision 1- Applicability
- DiskStation Manager (DSM < 7.2.1-69057-13, < 7.2.2-72806-10, < 7.3.2-86009-5, < 7.4.1-90080-1)
- Evidence
- Unknown
- Severity
- High
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 06:13 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Synology DiskStation Manager (DSM) is vulnerable to an authentication bypass via an alternate path or channel within its rsync implementation (CVE-2026-85101). This vulnerability allows unauthenticated remote attackers to perform unauthorized file operations, including reading and writing arbitrary files, or disrupting system availability through denial-of-service. The vulnerability is rated with a CVSS v3.1 base score of 8.6.
Impact
Successful exploitation allows remote attackers to manipulate files on the affected device, potentially leading to unauthorized data access, system modification, or service disruption.
Recommendation
Immediately apply the relevant security patches for Synology DiskStation Manager (DSM) to remediate the vulnerability. Users must verify their DSM version and update to at least 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, or 7.4.1-90080-1, depending on their environment.
Immediate actions
Patch Synology DiskStation Manager (DSM) to the respective version: 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, or 7.4.1-90080-1.
Threat Hunt
Identify unauthorized rsync session activity or unexpected connection patterns to DSM services from untrusted external sources.
Data: Network traffic logs, DSM connection logs
Mitigations
Upgrade to patched DSM versions: 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, or 7.4.1-90080-1.
CVE-2026-85101