CVE-2026-85098 · Infrastructure
NO FIX YET · SEE WHAT TO DO
A reachable assertion in the synoscgi component of Synology DiskStation Manager (DSM) lets remote attackers crash part of the service. The sources describe only a limited denial-of-service impact, with no code execution or data exposure stated.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Synology DiskStation Manager installs older than 7.3.2-86009-5 on the 7.3 branch or older than 7.4.1-90080-1 on the 7.4 branch. The sources do not say whether the synoscgi endpoint is reachable by default, so teams should check whether their NAS is exposed to the internet. Only denial of service is described, so teams with no internet-facing DSM can treat it as low priority.
Not affected if fixed-version, no-internet-exposure
Who cares dsm, nas, self-hosted, synology
7.3.2-86009-5 or 7.4.1-90080-17.3.2-86009-5 or later7.4.1-90080-1 or laterA reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct limited denial-of-service attacks.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.