Vulnerabilities

An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13…

An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Synology

Product

DiskStation Manager (DSM)

CVSS v3.1

8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Weakness

CWE-288

Exposure class

Operating system, Storage / NAS

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-85101 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 30
   CVE NVD 2h ago

   An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and…

   CVSS 8.1 CVE-2026-18596 Synology