PT-2026-61604 · Apache · Apache Syncope

Follycat + 1 · CVE-2026-53421 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1

Description Improper isolation or compartmentalization in the connector subsystem allows an administrator with adequate entitlements to achieve remote code execution. This is possible by leveraging the capability of scripted connectors, specifically REST and SQL, to execute Groovy scripts.

Recommendations Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.7. Upgrade versions 4.0.0-M0 through 4.0.6 to version 4.0.7. Upgrade versions 4.1.0-M0 through 4.1.1 to version 4.1.2.

Fix

Weakness Enumeration

CWE-653

Related Identifiers

CVE-2026-53421

Affected Products

Apache Syncope

References · 4

• https://lists.apache.org/thread/nmzvz6gb2ldm30wvyk613r8dfrb6r8yx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53421 · Security Note
• https://twitter.com/vulnipulse/status/2079214296144425453 · Twitter Post
• http://openwall.com/lists/oss-security/2026/07/20/7 · Note