Vulnerabilities

An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and…

An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with valid user credentials to read or write arbitrary files and conduct denial-of-service attacks.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Synology

Product

DiskStation Manager (DSM)

CVSS v3.1

8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness

CWE-288

Exposure class

Storage / NAS

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-18596 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 30
   CVE NVD 2h ago

   An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13…

   CVSS 8.6 CVE-2026-85101 Synology