Authentication Bypass Vulnerability in Synology DiskStation Manager
CVE-2026-85101

8.6HIGH

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
12 November 2026

What is CVE-2026-85101?

An authentication bypass vulnerability exists in Synology DiskStation Manager, which allows remote attackers to exploit the system using an alternate path or channel. This vulnerability enables unauthorized users to gain access to specific files, perform arbitrary file modifications, and execute limited denial-of-service attacks against devices running affected versions of the DiskStation Manager software.

Affected Version(s)

DiskStation Manager (DSM) 7.4.1

DiskStation Manager (DSM) 7.4.1 < 7.4.1-90080-1

DiskStation Manager (DSM) 7.3.2 < 7.3.2-86009-5

References

https://www.synology.com/en-global/security/advisory/Syno...

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Warisse Valentin (Aytio)
.