On November 10, 2026, Synology published a security advisory, Synology-SA-26:19, detailing two vulnerabilities. The advisory addresses CVE-2026-76954 and CVE-2026-85101, both of which can be exploited remotely without user authentication.
CVE-2026-76954 is rated as Critical with a CVSS score of 9.8. This vulnerability allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks. CVE-2026-85101, rated Important with a CVSS score of 8.6, permits remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks.
Synology's advisory indicates that there is no workaround for these vulnerabilities. The company recommends upgrading to fixed builds to mitigate the risks. As of the advisory's release, these vulnerabilities were not listed in CISA's Known Exploited Vulnerabilities catalog.
The vulnerabilities were discovered by researchers from Viettel Cyber Security Research Lab and Aytio. No exploitation of these vulnerabilities has been reported so far.