CVE-2026-4036

Published Sep 18, 2026·Updated Sep 18, 2026

NVD Description

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files.

Public Exploits & PoCs1 found

[POC] GHSA-3mgp-fx93-9xv5 — CVE-2026-40369

CVE-2026-40369本地权限提升漏洞exp

Community Discussion

Hacker News

CVE-2026-40369 – Windows Kernel Elevation of Privilege Vulnerability

l2dy

CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox

voidsec

Show HN: CVE-2026-40369 Windows Kernel Arbitrary Write Chrome SBX

orinimron123

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free