Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 3 total.

Severity: All Critical High

Library: apache_syncope

CVE-2026-63071 CRITICAL CVSS 9.8 Verified Advisory Jul 21, 2026

Groovy sandbox bypass enabling RCE in Apache Syncope (CVE-2026-63071)

Apache Syncope contains an Improper Isolation or Compartmentalization vulnerability in its Groovy security sandbox. An administrator with adequate entitlements for Implementations can create a malicious Groovy class c...

Fixed in 4.0.7; 4.1.2

Authentication Bypass Apache Apache Software Foundation Apache Syncope

CVE-2026-53405 CRITICAL CVSS 9.8 Verified Advisory Jul 21, 2026

Remote code execution via unsandboxed Groovy scriptTask in Apache Syncope (CVE-2026-53405)

Apache Syncope contains an improper isolation vulnerability in its Flowable BPMN extension that allows an administrator with adequate entitlements to import arbitrary BPMN process definitions via the REST API. When a ...

Fixed in 4.0.7; 4.1.2

Apache Information Disclosure Apache Software Foundation Apache Syncope

CVE-2026-53421 CRITICAL CVSS 9.8 Verified Advisory Jul 21, 2026

Remote code execution via scripted connector in Apache Syncope (CVE-2026-53421)

Apache Syncope contains an improper isolation or compartmentalization vulnerability in its connector subsystem. An administrator with adequate entitlements can achieve remote code execution by exploiting scripted conn...

Fixed in 4.0.7; 4.1.2

RCE Apache Apache Software Foundation Apache Syncope