中文 English Français Русский Español العربية

Synology DSM: 27 CVEs Including a 9.8 Pre-Auth SQLi — What to Patch and What to Hunt

dev.to DevOps2026-11-13 09:500 views

Synology published two advisories on 10 November fixing 27 vulnerabilities across all active DSM branches.
The headline CVE:

CVE-2026-76954 — CVSS 9.8, CWE-89, pre-auth SQL injection in the Auth API. Unauthenticated arbitrary file read/write. No workaround.

Also in the same wave:

CVE-2026-85101 — rsync auth bypass, 8.6, unauthenticated
CVE-2026-13672 / CVE-2026-18792 / CVE-2026-74857 — three 8.8s (SSOAuth, Sharing API, Auth API)
CVE-2026-18596 — OTP bypass, 8.1
CVE-2026-75785 — VPN API command injection, 7.2

Fixed builds:

DSM 7.4 → 7.4.1-90080-1
DSM 7.3 → 7.3.2-86009-5
DSM 7.2.2 → 7.2.2-72806-10
DSM 7.2.1 → 7.2.1-69057-13

Synology states no workaround exists for either advisory. The upgrade is the only remediation.

Full article with hunt checklist, compensating controls, and post-patch integrity review steps: threataft.com

Source：https://dev.to/threataft_dev/synology-dsm-27-cves-including-a-98-pre-auth-sqli-what-to-patch-and-what-to-hunt-2a06

My favorites

Previoustimeout Returned 124 After the Job Had Finished Its Work: Testing GNU timeout on a Nightly Clip Script NextVulnerability assessment vs penetration testing: what two scanners found in 27 known flaws

Post-Training Supply Chain Attacks on Coding Agents: Planting Tool-Execution Backdoors via Dataset and Checkpoint Poisoning

1. Basic Information Article Title : Trained to betray: How post-training supply chain attacks hijack coding agents Publ

0dev.to Security

NextScan's Hardcoded JWT Key Turns an Internal Scanner Into an Admin Takeover

NextScan's Hardcoded JWT Key Turns an Internal Scanner Into an Admin Takeover NextScan is a security scanning project wh

0dev.to Security

Vulnerability assessment vs penetration testing: what two scanners found in 27 known flaws

A vulnerability scan is an automated tool that checks a system against known weaknesses, and a penetration test is a per

0dev.to DevOps

Balancing Open-Source Cybersecurity Notes with Legal and Compliance Risks

The Anatomy of Open-Source Cybersecurity Notes Contemporary self-directed cybersecurity education relies on decentralize

0dev.to

Apache HTTP Server CVE-2026-119618: Critical mod_http2 RCE, Who Is Exposed and What to Do

Short answer CVE-2026-119618 is a critical flaw in mod_http2, the module that serves HTTP/2 in Apache HTTP Server 2.4.55

0dev.to DevOps

Fixing one bug in my security tool would have hidden every alert in my test project

I maintain depquiet . It sits on top of pip-audit, uv audit and npm audit and tries to cut down the noise. The one rule

0dev.to DevOps

Synology DSM: 27 CVEs Including a 9.8 Pre-Auth SQLi — What to Patch and What to Hunt

Related posts

Post-Training Supply Chain Attacks on Coding Agents: Planting Tool-Execution Backdoors via Dataset and Checkpoint Poisoning

NextScan's Hardcoded JWT Key Turns an Internal Scanner Into an Admin Takeover

Vulnerability assessment vs penetration testing: what two scanners found in 27 known flaws

Balancing Open-Source Cybersecurity Notes with Legal and Compliance Risks

Apache HTTP Server CVE-2026-119618: Critical mod_http2 RCE, Who Is Exposed and What to Do

Fixing one bug in my security tool would have hidden every alert in my test project