{"id":"CVE-2026-81584","kind":"vulnerability","aliases":["CVE-2026-81584"],"related":[],"title":"Synology DSM: User API SQL flaw lets LDAP servers read or write files","description":"An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files and conduct denial-of-service attacks.","summary":"Synology DiskStation Manager's User API builds SQL commands from data supplied by an LDAP or Active Directory server without proper neutralization. A remote attacker who controls such a directory server can read or write arbitrary files on the NAS and cause denial of service.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","dsm","infrastructure","ldap","nas","synology"],"not_affected_if":["already-patched","local-accounts-only","no-ldap-integration"],"how_to_check":"- Check the installed DSM version in Control Panel > Info Center (or `cat /etc/VERSION` over SSH on the NAS)\n- Check whether LDAP or Active Directory integration is enabled for the NAS user accounts","fix":"- Move DSM to `7.3.2-86009-5` or later on the 7.3 branch\n- Move DSM to `7.4.1-90080-1` or later on the 7.4 branch","status":"open","published_at":"2026-11-12T04:17:21+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","triaged_at":"2026-11-12T04:47:40+00:00","updated_at":"2026-11-12T04:47:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T04:47:40Z","model":"claude-haiku-5-5","output":{"fix":"- Move DSM to `7.3.2-86009-5` or later on the 7.3 branch\n- Move DSM to `7.4.1-90080-1` or later on the 7.4 branch","reach":"network","title":"Synology DSM: User API SQL flaw lets LDAP servers read or write files","impact":"high","summary":"Synology DiskStation Manager's User API builds SQL commands from data supplied by an LDAP or Active Directory server without proper neutralization. A remote attacker who controls such a directory server can read or write arbitrary files on the NAS and cause denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","ldap","active-directory"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads or writes arbitrary files on the NAS","analyst_note":"","how_to_check":"- Check the installed DSM version in Control Panel > Info Center (or `cat /etc/VERSION` over SSH on the NAS)\n- Check whether LDAP or Active Directory integration is enabled for the NAS user accounts","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["local-accounts-only","no-ldap-integration","already-patched"],"who_is_affected":"Systems running Synology DSM before 7.3.2-86009-5 or 7.4.1-90080-1 that use LDAP or Active Directory for user accounts are the exposed ones. The attacker has to control or compromise the directory server that DSM queries, so NAS units with local accounts only are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4566,"output_tokens":594,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':101C '-2026':15A,18A '-5':97C '-81584':16A,19A '-86009':96C '-90080':100C '7.3.2':95C '7.4.1':99C 'activ':21B,44B,112C 'active-directori':20B 'allow':102C 'api':4A,33B,88C 'arbitrari':63B,119C 'attack':52B,104C,127C 'build':34B 'caus':69B 'command':36B,83C 'compromis':109C 'conduct':122C 'control':54B,106C 'cve':14A,17A 'data':38B 'denial':70B,124C 'denial-of-servic':123C 'directori':22B,45B,57B,113C 'diskstat':29B,91C 'dsm':2A,23B,93C 'element':78C 'file':13A,64B,120C 'flaw':6A 'improp':74C 'infrastructur':24B 'ldap':8A,25B,42B,110C 'let':7A 'manag':30B,92C 'nas':26B,67B 'neutral':49B,75C 'proper':48B 'read':10A,60B,116C 'remot':51B,103C 'server':9A,46B,58B,114C 'servic':72B,126C 'special':77C 'sql':5A,35B,82C 'suppli':39B 'synolog':1A,27B,28B,90C 'use':79C 'user':3A,32B,87C 'vulner':84C 'without':47B 'write':12A,62B,118C","nicknames":[],"mitigations":[],"who_affected":"Systems running Synology DSM before 7.3.2-86009-5 or 7.4.1-90080-1 that use LDAP or Active Directory for user accounts are the exposed ones. The attacker has to control or compromise the directory server that DSM queries, so NAS units with local accounts only are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activedirectory","dsm","high","infrastructure","ldap","nas","synology"],"campaign_type":null,"search_a":"'-2026':15A,18A '-81584':16A,19A 'api':4A 'cve':14A,17A 'dsm':2A 'file':13A 'flaw':6A 'ldap':8A 'let':7A 'read':10A 'server':9A 'sql':5A 'synolog':1A 'user':3A 'write':12A","search_b":"'activ':21B,44B 'active-directori':20B 'api':33B 'arbitrari':63B 'attack':52B 'build':34B 'caus':69B 'command':36B 'control':54B 'data':38B 'denial':70B 'directori':22B,45B,57B 'diskstat':29B 'dsm':23B 'file':64B 'infrastructur':24B 'ldap':25B,42B 'manag':30B 'nas':26B,67B 'neutral':49B 'proper':48B 'read':60B 'remot':51B 'server':46B,58B 'servic':72B 'sql':35B 'suppli':39B 'synolog':27B,28B 'user':32B 'without':47B 'write':62B","search_c":"'-1':101C '-5':97C '-86009':96C '-90080':100C '7.3.2':95C '7.4.1':99C 'activ':112C 'allow':102C 'api':88C 'arbitrari':119C 'attack':104C,127C 'command':83C 'compromis':109C 'conduct':122C 'control':106C 'denial':124C 'denial-of-servic':123C 'directori':113C 'diskstat':91C 'dsm':93C 'element':78C 'file':120C 'improp':74C 'ldap':110C 'manag':92C 'neutral':75C 'read':116C 'remot':103C 'server':114C 'servic':126C 'special':77C 'sql':82C 'synolog':90C 'use':79C 'user':87C 'vulner':84C 'write':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81584","severity":null,"published_at":"2026-11-12T04:17:21+00:00","modified_at":"2026-11-12T04:17:21+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","fetched_at":"2026-11-12T04:47:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}