Critical SQL Injection Vulnerability in Synology DSM Affects Multiple Versions

## Overview Synology has disclosed a critical vulnerability in the DiskStation Manager (DSM) affecting versions prior to 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. This flaw, identified as CVE-2026-76954, is classified with a CVSS score of 9.8, indicating a high severity level. ## Technical Details The vulnerability arises from improper neutralization of special elements used in SQL commands within the Auth API. This weakness allows remote attackers to execute SQL injection attacks without requiring authentication. As a result, attackers can read or write arbitrary files on the affected systems. Additionally, this vulnerability can lead to denial-of-service attacks, further compromising the availability of the affected services. ## Impact Exploitation of CVE-2026-76954 could enable attackers to gain unauthorized access to sensitive data or disrupt services on Synology devices. The ability to execute commands without logging in significantly increases the risk for users, making it crucial for organizations to address this flaw promptly. ## Mitigation Defenders should immediately update their Synology DSM installations to the latest patched versions. Synology has released updates to mitigate this vulnerability. Users are urged to verify their current version and apply the necessary patches as soon as possible to protect against potential exploitation. Failure to update may leave systems vulnerable to attacks that could compromise data integrity and availability.