Dashboard / CVE-2026-53421

CVE-2026-53421

CRITICAL
INFO Priority: 0.11 BB Relevance: 80/100
Published: 2026-07-20 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
apache syncope 3.0.0 – 3.0.16
apache syncope 4.0.0 – 4.0.7
apache syncope 4.1.0 – 4.1.2

References & Advisories (2)

Bug Bounty Relevance

80 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

1.14%
Raw Score 0.011370
Percentile 66.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.01137
2026-10-28
0.01137

Intelligence Sources

nvd ref →

External Links