Vulnerability record/PUBLISHED/Published Nov 12, 2026 03:36:38 UTC
CVE-2026-81557
An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.
Base score5.4/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionRequiredUI
ScopeChangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authoritysynology
Last updatedNov 12, 2026 03:36:38 UTC
PublishedNov 12, 2026 03:36:38 UTC
ReservedAug 27, 2026 04:39:53 UTC
Credits
- Lubin Leclanche