SecNews@SecNews_GR
CVE-2026-113687: Δύο νέες ευπάθειες RCE στο Apache Syncope https://www.secnews.gr/746640/cve-2026-113687-apache-syncope-rce/?fsp_sid=22057
01010150
7.0K followersView on X
CVE-2026-113687
LOWSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-653
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day