# Synology discloses remote attack flaws in NAS software

_Published Thursday, November 12, 2026 at 1:19 PM EST · Security · Latest · Tier 2 — Notable_

![Synology discloses remote attack flaws in NAS software — TechSpot](https://www.techspot.com/images2/news/bigimage/2026/11/2026-11-12-image-13.jpg)

Synology has disclosed two vulnerabilities that allow remote attacks without authentication against its DiskStation Manager storage software, TechSpot reports. CVE-2026-76954, an SQL injection flaw in the authentication interface, carries a 9.8 severity score and can allow arbitrary file reads, file writes or denial of service.

CVE-2026-85101 affects the rsync tool and can bypass authentication to read specific files, write arbitrary files or cause limited denial of service. Synology released fixes in October for DSM 7.4, 7.3, 7.2.2 and 7.2.1; devices using manual updates may still need patching.

## Sources

- [TechSpot](https://www.techspot.com/news/114524-synology-patches-critical-nas-flaw-could-attackers-without.html)

---
Canonical: https://techandbusiness.org/newswire/8EfkwuK-KrmClLeAOEwSs2
Published: 2026-11-12T18:19:36.024Z
Story chronology: 2026-11-12T17:37:00.000Z
Retrieved: 2026-11-12T19:49:38.340Z
Publisher: Tech & Business (techandbusiness.org)