Synology DiskStation Manager: OS command injection in VPN API (CVE-2026-75785)
CVE-2026-75785 is an improper neutralization of special elements used in an OS command vulnerability in the Synology DiskStation Manager (DSM) VPN API that allows remote authenticated administrators to read or write arbitrary files and conduct denial-of-service attacks.
CVE search metadata
CVE search record: CVE-2026-75785. Severity: high. CVSS: 7.2. KEV: no. Product: DiskStation Manager (< 7.3.2-86009-5, < 7.4.1-90080-1). Brief: Synology DiskStation Manager: OS command injection in VPN API (CVE-2026-75785). Brief link: https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-vpn-api-cve-2026-75785/
Triage facts
Revision 1- Applicability
- DiskStation Manager (< 7.3.2-86009-5, < 7.4.1-90080-1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 10:13 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Synology DiskStation Manager (DSM) contains an improper neutralization of special elements used in an OS command vulnerability within its VPN API (CVE-2026-75785).
Impact
The vulnerability allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks.