Authentication Bypass Vulnerability in Synology DiskStation Manager
CVE-2026-18596

8.1HIGH

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
12 November 2026

What is CVE-2026-18596?

An authentication bypass vulnerability in Synology DiskStation Manager allows remote attackers, who possess valid user credentials, to exploit alternate paths to read or write arbitrary files. This vulnerability potentially facilitates conduct of denial-of-service attacks, putting user data and availability at risk. Users are recommended to upgrade to the latest versions for improved security.

Affected Version(s)

DiskStation Manager (DSM) 7.4.1

DiskStation Manager (DSM) 7.4.1 < 7.4.1-90080-1

DiskStation Manager (DSM) 7.3.2 < 7.3.2-86009-5

References

https://www.synology.com/en-global/security/advisory/Syno...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

N/A
.