← CVE Radar
CVE-2026-76954
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
9.8 CRITICALEPSS 0.63%Not in KEVNVD: Awaiting Analysis
Overview
Severity
| Score | Severity | Version | Technologies Affected |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1synology (CNA) |
Details
- CVE ID
- CVE-2026-76954
- Status
- Awaiting Analysis
- Assigner (CNA)
- synology
- Published
- Nov 12, 2026
- Last modified
- 2026-11-12 18:50 UTC
- Weaknesses
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command
Affected Products
As published by the CNA in the CVE record.
SynologyDiskStation Manager (DSM)4 version ranges
- 7.4.1 before 7.4.1-90080-1
- 7.3.2 before 7.3.2-86009-5
- 7.2.2 before 7.2.2-72806-10
- 7.2.1 before 7.2.1-69057-13