PT-2026-144121
CVE-2026-76954
·
Published
2026-11-10
·
Updated
2026-11-12
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Synology DSM (affected versions not specified)
Description
A no-login SQL injection allows a remote attacker to read or overwrite files on the NAS without authentication. This issue bypasses security measures such as strong passwords and two-factor authentication (2FA) because the flaw exists within the login process itself.
Recommendations
Install the latest DSM update.
Remove the NAS from direct internet exposure and use a VPN instead.
Found an issue in the description? Have something to add? Feel free to write us 👾