Synology DSM: Check Patch Levels for Two Security Flaws
Checked 14 November 2026. In Synology-SA-26:19, Synology lists two fixed DSM vulnerabilities. CVE-2026-76954 affects the Auth API and is rated Critical by the vendor (CVSS 9.8). CVE-2026-85101 affects rsync and is rated Important (CVSS 8.6). Both descriptions concern remote network attacks without prior authentication. Synology marks the advisory resolved and specifies fixed minimum versions for four DSM branches.
This is a concrete update check, not evidence that every NAS was attacked or that a particular device is reachable. The key details are the DSM version installed on the NAS and whether it has reached the corrected version for its branch.
At a glance
Compare your exact branch and full DSM version with the table. Synology’s thresholds are branch-specific. “Or later” applies within that branch; it does not mean you should jump to another major branch without checking model support. Synology also notes that availability can vary by model or region.
Which DSM versions contain the fixes?
| DSM branch | Minimum fixed version | Check |
|---|---|---|
| DSM 7.4 | 7.4.1-90080-1 or later | Use the package for the exact NAS model. |
| DSM 7.3 | 7.3.2-86009-5 or later | Staged rollout or manual update may apply. |
| DSM 7.2.2 | 7.2.2-72806-10 or later | Do not substitute the 7.2.1 package. |
| DSM 7.2.1 | 7.2.1-69057-13 or later | Do not substitute the 7.2.2 package. |
Synology describes CVE-2026-76954 as an Auth API issue that could allow remote file reads or writes and cause denial of service. CVE-2026-85101 concerns rsync and could allow reading specific files, writing arbitrary files, and limited service disruption. These are potential impacts stated in the advisory, not confirmation of an incident on your NAS.
Find the installed version
- Sign in locally or through your normal secure administration method.
- Open Control Panel > Info Center > General, or Control Panel > Update & Restore > DSM Update. Synology documents these routes in its version-check guide.
- Record the model, complete version string and update number. The branch name alone is not enough to select a manual package.
- Compare that string with the matching table row. An older build means the fix is not yet confirmed; next check the update offered for your exact model.
If DSM does not offer an update
Synology’s DSM release notes explain that an update may not appear automatically. Availability can be staged by region, and the system may determine that a device is working without needing that update. For this advisory, Synology lists no additional mitigation. Do not rely on an empty update screen alone: check the installed version against the advisory.
If the corrected build is available for your model, follow Synology’s manual DSM update instructions: download the package for the exact model from Synology Download Center, open the manual update function in DSM, select the matching PAT file, and wait for the restart to finish. Packages are not interchangeable between models or DSM branches. Back up important data and configuration according to your normal process, plan for the restart, and avoid updating over an unreliable connection.
Verify after installation
After restart, reopen the DSM version page and confirm that the complete version string meets or exceeds the threshold for your branch. Then check the services you rely on and the update status in DSM. If installation fails, the version is unclear, or the device can only move to an older DSM branch, compare the exact model with Synology’s compatibility and download information before taking another step.
For hardware context, see our Synology DS224+ and QNAP TS-264 comparison. It does not replace checking the DSM version actually installed on your NAS.
Sources and review date
- Synology-SA-26:19 DSM — affected components, severity and fixed minimum versions; checked 14 November 2026.
- CERT.LV: Synology DSM vulnerabilities — independent public-sector cross-check of affected branches and fixed versions; checked 14 November 2026.
- Synology Knowledge Center: manual DSM update — official model-specific package installation steps; checked 14 November 2026.
- Synology Knowledge Center: check the DSM version — official version-check locations; checked 14 November 2026.
- Synology DSM release notes — rollout and update availability notes; checked 14 November 2026.
Author: TechDesk PE Digital.Networks