Synology DiskStation Manager: SQL Injection in User API (CVE-2026-81584)
An SQL injection vulnerability in the Synology DiskStation Manager (DSM) User API, tracked as CVE-2026-81584, allows remote attackers who have compromised an integrated LDAP or Active Directory server to perform arbitrary file operations or trigger a denial-of-service.
CVE search metadata
CVE search record: CVE-2026-81584. Severity: high. CVSS: 8.1. KEV: no. Product: DiskStation Manager (< 7.3.2-86009-5, < 7.4.1-90080-1), DiskStation Manager (< 7.4.1-90080-1, < 7.3.2-86009-5). Brief: Synology DiskStation Manager: SQL Injection in User API (CVE-2026-81584). Brief link: https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-sqli-cve-2026-81584/
Triage facts
Revision 1- Applicability
- DiskStation Manager (< 7.3.2-86009-5, < 7.4.1-90080-1), DiskStation Manager (< 7.4.1-90080-1, < 7.3.2-86009-5)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 09:31 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-81584 describes an improper neutralization of special elements used in an SQL command within the User API of Synology DiskStation Manager (DSM). The vulnerability is exploitable by an attacker who has already gained control over an integrated LDAP or Active Directory server used by the DSM instance. Successful exploitation allows for arbitrary file read and write operations, as well as denial-of-service attacks against the Synology appliance.
Impact
Exploitation can lead to unauthorized data access, system modification, or denial-of-service. The CVSS v3.1 base score for this vulnerability is 8.1.
Recommendation
- Upgrade to Synology DSM version 7.3.2-86009-5 or 7.4.1-90080-1 or later to remediate this vulnerability.
- Ensure that integrated LDAP and Active Directory infrastructure is hardened and monitored, as compromise of these services is a prerequisite for exploiting this vulnerability.
- Monitor DSM access logs and system resource utilization for signs of unauthorized API access or unexpected service interruptions.
Immediate actions
Upgrade affected Synology DSM instances to version 7.3.2-86009-5 or 7.4.1-90080-1 or later.
Threat Hunt
Investigate unauthorized modifications or abnormal administrative activity originating from credentials associated with integrated LDAP or Active Directory accounts.
Data: Synology DSM API access logs, LDAP/AD authentication logs
Mitigations
Patch Synology DSM to 7.3.2-86009-5 or 7.4.1-90080-1.
CVE-2026-81584