CVE-2026-53405— Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.0-M0≤ 3.0.16 | affected |
4.0.0-M0≤ 4.0.6 | affected | ||
4.1.0-M0≤ 4.1.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-53405
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的划分
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Syncope 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache syncope是美国Apache基金会开源的一套身份管理自动化工具。 Apache Syncope 3.0.0-M0至3.0.16版本、4.0.0-M0至4.0.6版本、4.1.0-M0至4.1.1版本存在权限许可和访问控制问题漏洞，该漏洞源于隔离或分区化不当，管理员可通过REST API导入任意BPMN流程定义并启动，当包含Groovy scriptTask的BPMN流程被导入和启动时，Groovy脚本直接在服务器上执行且没有沙箱保护。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.0-M0 ~ 3.0.16 | - |
II. Public POCs for CVE-2026-53405
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53405
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-53405 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-20 · 10 CVEs total
| CVE-2026-56452 | 7.5 HIGH | Apache MINA SSHD: Path traversal in SCP file reception |
| CVE-2026-56624 | 7.3 HIGH | Apache MINA SSHD: SSH certificate options lack validations |
| CVE-2026-56623 | 7.1 HIGH | Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows |
| CVE-2026-58624 | 5.4 MEDIUM | Apache MINA SSHD: Remote execution of JGit commands can write files on the server |
| CVE-2026-63071 | Apache Syncope: RCE via Groovy Sandbox bypass | |
| CVE-2026-53421 | Apache Syncope: Remote Code Execution via Scripted Connector | |
| CVE-2026-57308 | Apache Syncope: SQL injection vulnerability in Audit Events search | |
| CVE-2026-62183 | Apache Syncope: User self-service privilege escalation | |
| CVE-2026-62418 | Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check |
IV. Related Vulnerabilities
Same product: Apache Syncope
- CVE-2026-62418
Apache Syncope: Low-privileged authenticated SSRF in Connect - CVE-2026-62183
Apache Syncope: User self-service privilege escalation - CVE-2026-57308
Apache Syncope: SQL injection vulnerability in Audit Events - CVE-2026-53421
Apache Syncope: Remote Code Execution via Scripted Connector - CVE-2026-63071
Apache Syncope: RCE via Groovy Sandbox bypass
Same vendor: Apache Software Foundation
- CVE-2026-60080
Apache Fory: Rust MetaString heap use-after-free - CVE-2026-64606
Apache Fory, Apache Fory: Class-registration bypass through - CVE-2026-64609
Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Un - CVE-2026-64608
Apache Fory: Heap type confusion and out-of-bounds read/writ - CVE-2026-56623
Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git
Same weakness: CWE-653
- CVE-2026-53421
Apache Syncope: Remote Code Execution via Scripted Connector - CVE-2026-63071
Apache Syncope: RCE via Groovy Sandbox bypass - CVE-2026-15738
Cross-namespace traffic interception via incorrect route pre - CVE-2026-41155
GPU DDK - SharedSecMem mapped into all GPU virtual address s - CVE-2026-42782
Apache Syncope: Post-auth RCE via Groovy static
V. Comments for CVE-2026-53405
No comments yet