NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
HIGH severity

CVE-2026-81584 — DiskStation Manager (DSM)

HIGH

CVE-2026-81584 is a high-severity (CVSS 8.1) SQL Injection vulnerability in Synology DiskStation Manager (DSM). A fix is available — see the affected versions and patch details below.

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows…

Published
Updated
Affected
1 product
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 12, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Description

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files and conduct denial-of-service attacks.

Affected Products

1 product · 1 configurations
Application
DiskStation Manager (DSM)Synology
< 7.4.1-90080-1
2 versions
7.4.17.3.2

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every Synology DiskStation Manager (DSM) deployment and check each version against the affected-products list above.

  2. Fix

    Apply the Synology DiskStation Manager (DSM) security patch or hotfix for CVE-2026-81584 on the affected version, following the vendor advisory for your exact build.

  3. Workarounds

    Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files and conduct denial-of-service attacks.
O3 Security · Runtime Protection

Is CVE-2026-81584 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
CVE-2026-81584: DiskStation Manager (DSM) (High 8.1)