Remote code execution via scripted connector in Apache Syncope (CVE-2026-53421)

Apache Syncope contains an improper isolation or compartmentalization vulnerability in its connector subsystem. An administrator with adequate entitlements can achieve remote code execution by exploiting scripted connectors' (REST and SQL) capability to execute Groovy scripts. This issue is addressed by hardening the Groovy security sandbox in the fixed releases. Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.6 - Apache Syncope 4.1.0-M0 through 4.1.1 We recommend updating to: 4.0.7, 4.1.2. CVSS 9.8 · our assessment: act_now Reference: https://lists.apache.org/thread/nmzvz6gb2ldm30wvyk613r8dfrb6r8yx Details: https://vuln.today/cve/CVE-2026-53421