{"id":"CVE-2026-85098","kind":"vulnerability","aliases":["CVE-2026-85098"],"related":[],"title":"Synology DSM: reachable assertion in synoscgi allows limited denial of service","description":"A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct limited denial-of-service attacks.","summary":"A reachable assertion in the synoscgi component of Synology DiskStation Manager (DSM) lets remote attackers crash part of the service. The sources describe only a limited denial-of-service impact, with no code execution or data exposure stated.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["fixed-version","no-internet-exposure"],"how_to_check":"- Check the DSM version under Control Panel > Info Center and compare it with `7.3.2-86009-5` or `7.4.1-90080-1`","fix":"- Move DSM 7.3 installs to `7.3.2-86009-5` or later\n- Move DSM 7.4 installs to `7.4.1-90080-1` or later","status":"open","published_at":"2026-11-12T04:17:21+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","triaged_at":"2026-11-12T04:47:58+00:00","updated_at":"2026-11-12T04:47:58+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T04:47:58Z","model":"claude-haiku-5-5","output":{"fix":"- Move DSM 7.3 installs to `7.3.2-86009-5` or later\n- Move DSM 7.4 installs to `7.4.1-90080-1` or later","reach":"network","title":"Synology DSM: reachable assertion in synoscgi allows limited denial of service","impact":"low","summary":"A reachable assertion in the synoscgi component of Synology DiskStation Manager (DSM) lets remote attackers crash part of the service. The sources describe only a limited denial-of-service impact, with no code execution or data exposure stated.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker crashes the synoscgi service, causing limited denial of service","analyst_note":"","how_to_check":"- Check the DSM version under Control Panel > Info Center and compare it with `7.3.2-86009-5` or `7.4.1-90080-1`\n- unknown for other checks: the sources do not say which configuration exposes synoscgi","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-internet-exposure"],"who_is_affected":"Synology DiskStation Manager installs older than 7.3.2-86009-5 on the 7.3 branch or older than 7.4.1-90080-1 on the 7.4 branch. The sources do not say whether the synoscgi endpoint is reachable by default, so teams should check whether their NAS is exposed to the internet. Only denial of service is described, so teams with no internet-facing DSM can treat it as low priority.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000764,"input_tokens":4552,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':83C '-2026':13A,16A '-5':79C '-85098':14A,17A '-86009':78C '-90080':82C '7.3.2':77C '7.4.1':81C 'allow':7A,84C 'assert':4A,27B,66C 'attack':39B,86C,94C 'code':58B 'compon':31B 'conduct':88C 'crash':40B 'cve':12A,15A 'data':61B 'denial':9A,52B,91C 'denial-of-servic':51B,90C 'describ':47B 'diskstat':34B,73C 'dsm':2A,18B,36B,75C 'execut':59B 'exposur':62B 'host':23B 'impact':55B 'infrastructur':19B 'let':37B 'limit':8A,50B,89C 'manag':35B,74C 'nas':20B 'part':41B 'reachabl':3A,26B,65C 'remot':38B,85C 'self':22B 'self-host':21B 'servic':11A,44B,54B,93C 'sourc':46B 'state':63B 'synolog':1A,24B,33B,72C 'synoscgi':6A,30B,70C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Synology DiskStation Manager installs older than 7.3.2-86009-5 on the 7.3 branch or older than 7.4.1-90080-1 on the 7.4 branch. The sources do not say whether the synoscgi endpoint is reachable by default, so teams should check whether their NAS is exposed to the internet. Only denial of service is described, so teams with no internet-facing DSM can treat it as low priority.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-2026':13A,16A '-85098':14A,17A 'allow':7A 'assert':4A 'cve':12A,15A 'denial':9A 'dsm':2A 'limit':8A 'reachabl':3A 'servic':11A 'synolog':1A 'synoscgi':6A","search_b":"'assert':27B 'attack':39B 'code':58B 'compon':31B 'crash':40B 'data':61B 'denial':52B 'denial-of-servic':51B 'describ':47B 'diskstat':34B 'dsm':18B,36B 'execut':59B 'exposur':62B 'host':23B 'impact':55B 'infrastructur':19B 'let':37B 'limit':50B 'manag':35B 'nas':20B 'part':41B 'reachabl':26B 'remot':38B 'self':22B 'self-host':21B 'servic':44B,54B 'sourc':46B 'state':63B 'synolog':24B,33B 'synoscgi':30B","search_c":"'-1':83C '-5':79C '-86009':78C '-90080':82C '7.3.2':77C '7.4.1':81C 'allow':84C 'assert':66C 'attack':86C,94C 'conduct':88C 'denial':91C 'denial-of-servic':90C 'diskstat':73C 'dsm':75C 'limit':89C 'manag':74C 'reachabl':65C 'remot':85C 'servic':93C 'synolog':72C 'synoscgi':70C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85098","severity":null,"published_at":"2026-11-12T04:17:21+00:00","modified_at":"2026-11-12T04:17:21+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","fetched_at":"2026-11-12T04:47:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}