CVE-2026-4036

MediumCVSS 6.5/10Last modified Sep 18, 2026

Description

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 18, 2026
Last modified
Sep 18, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-403607.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-403618.4Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-403627.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-403638.4Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-403648.4Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code localCVE-2026-403658.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-403668.4Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code localCVE-2026-403678.4Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code localCVE-2026-403688.0Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-403697.8Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-403708.8External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-403718.8Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate
CVE-2026-4036: Medium severity, CVSS 6.5 | Vulnix