Synology DSM 7.2.1 to 7.4 security update: what to do

Synology published two DSM security advisories on 10 November 2026. The critical one, Synology-SA-26:19, covers DSM 7.2.1, 7.2.2, 7.3 and 7.4. The second, Synology-SA-26:18, is rated important and fixes more than 20 bugs in DSM 7.3 and 7.4. There is no workaround. If your office has a Synology NAS, update DSM this week.

What did Synology fix?

The critical bug sits in the DSM login part (the Auth API). Synology says someone on the network, with no account at all, could use it to read or change files on the NAS or make it stop working. The same advisory fixes a second serious hole in the rsync service, which many offices use to copy backups between two boxes.

The second advisory is longer. Most of its bugs need a working user account first, but some do not, for example ones in WebDAV and NFS file sharing. Synology has not said that any of these holes are being used in attacks.

Which DSM versions need the update?

These builds are newer than the ones in our Synology ransomware notice from last week. A NAS updated then still needs this round.

What to do

1. Before you start, make sure the latest backup finished and can be opened. Copy anything you cannot lose to a USB drive or the cloud.
2. Log in to DSM as an administrator. Go to Control Panel, then Update & Restore, and note the version shown.
3. If it is older than the build in the table, download and install the update there. The NAS restarts, so pick a time after office hours and tell staff the shared drives will be offline for a while.
4. After the restart, open Update & Restore again and confirm the new version number. Check that shared folders and backup jobs work.
5. Turn on automatic updates in the same screen so future security fixes go in by themselves.

Is your NAS open to the internet?

If staff reach the NAS from home through QuickConnect, or a port is opened on the office router, the risk is higher. Ask whoever set it up.

• Close any router port you do not need, and turn off QuickConnect if no one uses it.
• If people do need outside access, use a VPN so the DSM login page is not open to the whole internet.
• Turn on two-step login for every admin account and remove old accounts nobody uses.
• Switch off rsync, WebDAV and NFS if you do not use them.

If someone else looks after your NAS, forward this page to them today.

Source and credit

We are sharing this news from Synology. This summary is written by Synctech in our own words.

• Synology-SA-26:19 DSM, Synology, 10 November 2026: https://www.synology.com/en-global/security/advisory/Synology_SA_26_19
• Synology-SA-26:18 DSM, Synology, 10 November 2026: https://www.synology.com/en-global/security/advisory/Synology_SA_26_18

Retrieved 11 Nov 2026. Synology, DSM and QuickConnect are trademarks of Synology Inc. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.