CVE-2026-53421CWE-653

Apache Syncope: Remote Code Execution via Scripted Connector

Critical · published July 20, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

Improper Isolation or Compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01137 · 66.3th percentile
Weakness
CWE-653 · Improper Isolation or Compartmentalization
Published
2026-07-20T14:21Z
EPSS history
Timeline
  • 20 JUL 14:21Z
    Apache Syncope: Remote Code Execution via Scripted Connector
    cvelistv5