CVE-2026-76954
A NVD · · CVE-2026-76954
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 9.8
- EPSS
- 0%
Key insight
Beyond the patch information itself, the key point is that the DSM Auth API forms an unauthenticated, externally reachable attack surface through which arbitrary files can be read and written , no workaround exists until the listed build versions are installed.
Description
The vulnerability affects the Auth API of Synology DiskStation Manager (DSM) and is an improper neutralization of special elements in SQL commands (SQL injection). Remote attackers can thereby read or write arbitrary files and conduct denial-of-service attacks against the device. DSM versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5 and 7.4.1-90080-1 are affected; the fixes are contained in these builds. At the time of the report there is no information on active exploitation, inclusion in the CISA KEV list, or a public proof of concept. Authentication is not required for the attack, which justifies the high severity rating.
Risk score
- cvss base
- 98.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 98.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
- vote penalty
- -10.00
Path: operational
Consensus check
Models disagree: Models disagree on severity
- Vote penalty:
- −10.0
- Total penalty:
- −10.0