{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/diskstation-manager--7.3.2-86009-5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-18596"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DiskStation Manager (\u003c 7.3.2-86009-5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Synology"],"content_html":"\u003cp\u003eCVE-2026-18596 is an authentication bypass using an alternate path or channel vulnerability in the One-Time Password (OTP) mechanism of Synology DiskStation Manager (DSM).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eRemote attackers with valid user credentials can exploit this vulnerability to read or write arbitrary files and conduct denial-of-service attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eRefer to the vendor advisory for patch guidance and affected version information.\u003c/p\u003e\n","date_modified":"2026-11-12T06:13:05Z","date_published":"2026-11-12T06:13:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-auth-bypass-cve-2026-18596/","summary":"An authentication bypass vulnerability in the OTP implementation of Synology DiskStation Manager (DSM) allows remote attackers with valid credentials to access arbitrary files and perform denial-of-service attacks.","title":"Synology DiskStation Manager: Authentication Bypass via OTP (CVE-2026-18596)","url":"https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-auth-bypass-cve-2026-18596/"}],"language":"en","title":"CraftedSignal Threat Feed - DiskStation Manager (\u003c 7.3.2-86009-5)","version":"https://jsonfeed.org/version/1.1"}