PT-2026-43078 · Apache · Apache Syncope

Trung Nguyen · Published 2026-05-25 · Updated 2026-05-27 · CVE-2026-42782

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0 through 3.0.16 Apache Syncope versions 4.0 through 4.0.5 Apache Syncope version 4.1.0

Description Improper Isolation or Compartmentalization allows an administrator with sufficient entitlements for Implementations to create a malicious Groovy class. This class can contain untrusted code that reaches a non-sandboxed execution path through the class static initializer, potentially leading to remote code execution.

Recommendations For versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0, upgrade to version 4.0.6 or 4.1.1.

Exploit

Fix

RCE

Weakness Enumeration

CWE-653

Related Identifiers

CVE-2026-42782

GHSA-GQ7G-VG2Q-JVQ3

Affected Products

Apache Syncope

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42782.json · Exploit
• https://lists.apache.org/thread/b869ms0ofrd129f7tgsn9flxgv9ztg2r · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gq7g-vg2q-jvq3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42782 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42782 · Vendor Advisory
• https://twitter.com/oss_security/status/2059122685070721095 · Twitter Post
• https://t.me/CVEtracker/54880 · Telegram Post
• https://t.me/cveNotify/164935 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/25/4 · Note
• https://t.me/cveNotify/164931 · Telegram Post
• https://repo.maven.apache.org/maven2 · Note