DiskStation Manager (< 7.3.2-86009-5, < 7.4.1-90080-1) - CraftedSignal Threat Feed

Synology DiskStation Manager: OS command injection in VPN API (CVE-2026-75785)

hello@craftedsignal.io — Thu, 12 Nov 2026 10:13:20 +0000

Synology DiskStation Manager (DSM) contains an improper neutralization of special elements used in an OS command vulnerability within its VPN API (CVE-2026-75785).

Impact

The vulnerability allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks.

Synology DiskStation Manager: SQL Injection in User API (CVE-2026-81584)

hello@craftedsignal.io — Thu, 12 Nov 2026 09:31:11 +0000

CVE-2026-81584 describes an improper neutralization of special elements used in an SQL command within the User API of Synology DiskStation Manager (DSM). The vulnerability is exploitable by an attacker who has already gained control over an integrated LDAP or Active Directory server used by the DSM instance. Successful exploitation allows for arbitrary file read and write operations, as well as denial-of-service attacks against the Synology appliance.

Impact

Exploitation can lead to unauthorized data access, system modification, or denial-of-service. The CVSS v3.1 base score for this vulnerability is 8.1.

Recommendation

Upgrade to Synology DSM version 7.3.2-86009-5 or 7.4.1-90080-1 or later to remediate this vulnerability.
Ensure that integrated LDAP and Active Directory infrastructure is hardened and monitored, as compromise of these services is a prerequisite for exploiting this vulnerability.
Monitor DSM access logs and system resource utilization for signs of unauthorized API access or unexpected service interruptions.

Synology DiskStation Manager: Auth API missing authentication (CVE-2026-74857)

hello@craftedsignal.io — Thu, 12 Nov 2026 09:30:53 +0000

CVE-2026-74857 is a vulnerability in the Auth API component of Synology DiskStation Manager (DSM). The flaw involves a missing critical authentication step, which allows remote authenticated users to read or write arbitrary files on the system or conduct denial-of-service attacks.

Synology DiskStation Manager: Denial-of-service via nfsd (CVE-2026-18633)

hello@craftedsignal.io — Thu, 12 Nov 2026 09:30:32 +0000

Synology DiskStation Manager (DSM) contains an access of uninitialized pointer vulnerability in the nfsd component. This vulnerability, identified as CVE-2026-18633, can be exploited by a remote attacker to cause a denial-of-service (DoS) condition on the affected device. The vulnerability has a CVSS v3.1 base score of 7.5.

Impact

Successful exploitation allows a remote attacker to disrupt system availability by triggering a denial-of-service condition via the nfsd service.

Recommendation

Review vendor security advisories for updates addressing CVE-2026-18633.

Synology DiskStation Manager: Authorization Bypass in SSOAuth

hello@craftedsignal.io — Thu, 12 Nov 2026 09:30:22 +0000

CVE-2026-13672 is an authorization bypass vulnerability in the SSOAuth component of Synology DiskStation Manager (DSM). The flaw, which has a CVSS v3.1 base score of 8.8, involves a user-controlled key vulnerability that allows remote authenticated users to read or write arbitrary files and perform denial-of-service attacks on the affected device.