DiskStation Manager (< 7.3.2-86009-5, < 7.4.1-90080-1)

CVE-2026-75785 is an improper neutralization of special elements used in an OS command vulnerability in the Synology DiskStation Manager (DSM) VPN API that allows remote authenticated administrators to read or write arbitrary files and conduct denial-of-service attacks.

An SQL injection vulnerability in the Synology DiskStation Manager (DSM) User API, tracked as CVE-2026-81584, allows remote attackers who have compromised an integrated LDAP or Active Directory server to perform arbitrary file operations or trigger a denial-of-service.

A missing authentication step in the Synology DiskStation Manager Auth API (CVE-2026-74857) allows a remote authenticated user to perform unauthorized arbitrary file operations and denial-of-service.

An access of uninitialized pointer vulnerability in the nfsd component of Synology DiskStation Manager (DSM) allows remote attackers to conduct denial-of-service attacks.

An authorization bypass vulnerability in the SSOAuth component of Synology DiskStation Manager (DSM) allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.