CVE-2026-53421
Last modified
CVE-2026-53421 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Syncope | >= 3.0.0, <= 3.0.16 |
| Apache | Syncope | >= 4.0.0, < 4.0.7 |
| Apache | Syncope | >= 4.1.0, < 4.1.2 |
References
- https://lists.apache.org/thread/nmzvz6gb2ldm30wvyk613r8dfrb6r8yxMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/20/7Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-53421?
How severe is CVE-2026-53421?
How do I fix CVE-2026-53421?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-53409Improper Privilege Management in Zoom Rooms for Windows befo…7.8
- CVE-2026-5341The NMR Strava activities plugin for WordPress is vulnerable…6.4
- CVE-2026-53410A time-of-check to time-of-use (TOCTOU) race condition in th…7
- CVE-2026-53411A time-of-check to time-of-use (TOCTOU) race condition in th…7.8
- CVE-2026-53412Improper Input Validation in Zoom Desktop Client for Windows…9.8
- CVE-2026-5342A flaw has been found in LibRaw up to 0.22.0. This affects t…5.5
- CVE-2026-53422Observable Response Discrepancy vulnerability in Erlang OTP …4.3
- CVE-2026-53423Allocation of Resources Without Limits or Throttling vulnera…5.9
- CVE-2026-53426Allocation of Resources Without Limits or Throttling vulnera…8.2
- CVE-2026-53427Improper Neutralization of Input During Web Page Generation …2.3
- CVE-2026-53428Memory Allocation with Excessive Size Value vulnerability in…6.9
- CVE-2026-53429Missing Release of Memory after Effective Lifetime vulnerabi…6.9
Are you affected by CVE-2026-53421?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST