CVE-2026-53421— Apache Syncope: Remote Code Execution via Scripted Connector
Possible ATT&CK Techniques 1AI
T1059.004 · Unix ShellAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.0-M0≤ 3.0.16 | affected |
4.0.0-M0≤ 4.0.6 | affected | ||
4.1.0-M0≤ 4.1.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-53421
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Syncope: Remote Code Execution via Scripted Connector
Source: NVD (National Vulnerability Database)
Vulnerability Description
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
不充分的划分
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.0-M0 ~ 3.0.16 | - |
II. Public POCs for CVE-2026-53421
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53421
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-53421 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-20 · 10 CVEs total
| CVE-2026-56452 | 7.5 HIGH | Apache MINA SSHD: Path traversal in SCP file reception |
| CVE-2026-56624 | 7.3 HIGH | Apache MINA SSHD: SSH certificate options lack validations |
| CVE-2026-56623 | 7.1 HIGH | Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows |
| CVE-2026-58624 | 5.4 MEDIUM | Apache MINA SSHD: Remote execution of JGit commands can write files on the server |
| CVE-2026-63071 | Apache Syncope: RCE via Groovy Sandbox bypass | |
| CVE-2026-53405 | Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask | |
| CVE-2026-57308 | Apache Syncope: SQL injection vulnerability in Audit Events search | |
| CVE-2026-62183 | Apache Syncope: User self-service privilege escalation | |
| CVE-2026-62418 | Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check |
IV. Related Vulnerabilities
Same product: Apache Syncope
- CVE-2026-62418
Apache Syncope: Low-privileged authenticated SSRF in Connect - CVE-2026-62183
Apache Syncope: User self-service privilege escalation - CVE-2026-57308
Apache Syncope: SQL injection vulnerability in Audit Events - CVE-2026-53405
Apache Syncope: Remote Code Execution via Flowable BPMN Groo - CVE-2026-63071
Apache Syncope: RCE via Groovy Sandbox bypass
Same vendor: Apache Software Foundation
- CVE-2026-60080
Apache Fory: Rust MetaString heap use-after-free - CVE-2026-64606
Apache Fory, Apache Fory: Class-registration bypass through - CVE-2026-64609
Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Un - CVE-2026-64608
Apache Fory: Heap type confusion and out-of-bounds read/writ - CVE-2026-56623
Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git
Same weakness: CWE-653
- CVE-2026-53405
Apache Syncope: Remote Code Execution via Flowable BPMN Groo - CVE-2026-63071
Apache Syncope: RCE via Groovy Sandbox bypass - CVE-2026-15738
Cross-namespace traffic interception via incorrect route pre - CVE-2026-41155
GPU DDK - SharedSecMem mapped into all GPU virtual address s - CVE-2026-42782
Apache Syncope: Post-auth RCE via Groovy static
V. Comments for CVE-2026-53421
No comments yet