PT-2026-61603 · Apache · Apache Syncope

Follycat + 1 · CVE-2026-53405 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1

Description An improper isolation issue allows an administrator with sufficient entitlements to import arbitrary BPMN process definitions via the REST API and initiate the process. If the imported BPMN process contains a Groovy scriptTask, the script is executed directly on the server without a sandbox, potentially leading to arbitrary code execution.

Recommendations Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.7. Upgrade versions 4.0.0-M0 through 4.0.6 to version 4.0.7. Upgrade versions 4.1.0-M0 through 4.1.1 to version 4.1.2.

Fix

Weakness Enumeration

CWE-653

Related Identifiers

CVE-2026-53405

Affected Products

Apache Syncope

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-53405 · Security Note
• https://lists.apache.org/thread/vdq0tk6ylffz6trbgbllj9kb1ndzff7k · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/07/20/6 · Note
• https://twitter.com/vulnipulse/status/2079213794291835160 · Twitter Post