{"id":"CVE-2026-18596","kind":"vulnerability","aliases":["CVE-2026-18596"],"related":[],"title":"Synology DSM: OTP alternate path lets attackers bypass login, read or write files","description":"An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with valid user credentials to read or write arbitrary files and conduct denial-of-service attacks.","summary":"Synology DiskStation Manager has an authentication bypass in its one-time password (OTP) handling that uses an alternate path. A remote attacker who already holds a valid user's credentials can read or write arbitrary files and cause denial of service.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Synology DiskStation Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dsm","nas","self-hosted","synology","vendor"],"not_affected_if":["dsm-already-patched","no-remote-login-access"],"how_to_check":"- Check the installed DSM version in Control Panel > Info Center; compare against the fixed versions below.","fix":"- DSM before `7.3.2-86009-5` is affected; move to `7.3.2-86009-5` or later.\n- DSM before `7.4.1-90080-1` is affected; move to `7.4.1-90080-1` or later.","status":"open","published_at":"2026-11-12T04:17:18+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","triaged_at":"2026-11-12T04:47:44+00:00","updated_at":"2026-11-12T04:47:44+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-12T04:47:44Z","model":"claude-haiku-5-5","output":{"fix":"- DSM before `7.3.2-86009-5` is affected; move to `7.3.2-86009-5` or later.\n- DSM before `7.4.1-90080-1` is affected; move to `7.4.1-90080-1` or later.","reach":"internet","title":"Synology DSM: OTP alternate path lets attackers bypass login, read or write files","impact":"high","summary":"Synology DiskStation Manager has an authentication bypass in its one-time password (OTP) handling that uses an alternate path. A remote attacker who already holds a valid user's credentials can read or write arbitrary files and cause denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["synology","dsm","self-hosted","nas"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads or writes arbitrary files and disrupts the NAS","analyst_note":"Check Synology's security advisory for DSM to confirm the fixed versions and whether the flaw is reachable without OTP enabled.","how_to_check":"- Check the installed DSM version in Control Panel > Info Center; compare against the fixed versions below.\n- unknown for other checks: the sources do not say.","plain_action":"","product_name":"Synology DiskStation Manager","needs_analyst":true,"not_affected_if":["dsm-already-patched","no-remote-login-access"],"who_is_affected":"Any Synology NAS running DSM below the fixed versions where remote users can sign in, including those who can reach the login page from the internet. Exposure depends on having valid user credentials, so accounts with weak or shared passwords raise the risk. unknown whether non-default settings change exposure.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000775,"input_tokens":4561,"output_tokens":638,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':97C '-18596':16A,19A '-2026':15A,18A '-5':93C '-86009':92C '-90080':96C '7.3.2':91C '7.4.1':95C 'allow':98C 'alreadi':54B 'altern':4A,48B,77C 'arbitrari':65B,109C 'attack':7A,52B,100C,117C 'authent':35B,73C 'bypass':8A,36B,74C 'caus':68B 'channel':80C 'conduct':112C 'credenti':60B,104C 'cve':14A,17A 'denial':69B,114C 'denial-of-servic':113C 'diskstat':31B,87C 'diskstation':21A 'dsm':2A,23B,89C 'file':13A,66B,110C 'handl':44B 'hold':55B 'host':27B 'let':6A 'login':9A 'manag':32B,88C 'manager':22A 'nas':24B 'one':40B 'one-tim':39B 'otp':3A,43B,84C 'password':42B 'path':5A,49B,78C 'read':10A,62B,106C 'remot':51B,99C 'self':26B 'self-host':25B 'servic':71B,116C 'synolog':1A,28B,30B,86C 'synology':20A 'time':41B 'use':46B,75C 'user':58B,103C 'valid':57B,102C 'vendor':29B 'vulner':81C 'write':12A,64B,108C","nicknames":[],"mitigations":[],"who_affected":"Any Synology NAS running DSM below the fixed versions where remote users can sign in, including those who can reach the login page from the internet. Exposure depends on having valid user credentials, so accounts with weak or shared passwords raise the risk. unknown whether non-default settings change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["diskstationmanager","synologydiskstationmanager"],"ptokens":["diskstation","manager","synology"],"labels":["dsm","high","nas","selfhosted","synology","vendor"],"campaign_type":null,"search_a":"'-18596':16A,19A '-2026':15A,18A 'altern':4A 'attack':7A 'bypass':8A 'cve':14A,17A 'diskstation':21A 'dsm':2A 'file':13A 'let':6A 'login':9A 'manager':22A 'otp':3A 'path':5A 'read':10A 'synolog':1A 'synology':20A 'write':12A","search_b":"'alreadi':54B 'altern':48B 'arbitrari':65B 'attack':52B 'authent':35B 'bypass':36B 'caus':68B 'credenti':60B 'denial':69B 'diskstat':31B 'dsm':23B 'file':66B 'handl':44B 'hold':55B 'host':27B 'manag':32B 'nas':24B 'one':40B 'one-tim':39B 'otp':43B 'password':42B 'path':49B 'read':62B 'remot':51B 'self':26B 'self-host':25B 'servic':71B 'synolog':28B,30B 'time':41B 'use':46B 'user':58B 'valid':57B 'vendor':29B 'write':64B","search_c":"'-1':97C '-5':93C '-86009':92C '-90080':96C '7.3.2':91C '7.4.1':95C 'allow':98C 'altern':77C 'arbitrari':109C 'attack':100C,117C 'authent':73C 'bypass':74C 'channel':80C 'conduct':112C 'credenti':104C 'denial':114C 'denial-of-servic':113C 'diskstat':87C 'dsm':89C 'file':110C 'manag':88C 'otp':84C 'path':78C 'read':106C 'remot':99C 'servic':116C 'synolog':86C 'use':75C 'user':103C 'valid':102C 'vulner':81C 'write':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18596","severity":null,"published_at":"2026-11-12T04:17:18+00:00","modified_at":"2026-11-12T04:17:18+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","fetched_at":"2026-11-12T04:47:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}