CVE-2026-77051Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-09-15); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Cybersecurity News DE@cybsecuritynews44d
Disclosure
#schwachstellen Apache Syncope: Kritische SQL-Injection in mehreren Versionen geschlossen #apache #apachesyncope #cve202677051 https://cybersecurity-news.de/apache-syncope-cve-2026-77051-sql-injection
Post summary
The tweet announces a critical SQL injection vulnerability (CVE-2026-77051) affecting multiple versions of Apache Syncope, noting the issue has been closed in those versions, and provides a link to a news article for further details.
0000036
12 followersView on X
SecAlerts@SecAlertsCo46d
Disclosure
🗃️ Apache Syncope CVSS 9.8 SQLi — CVE-2026-77051. Unsanitized entityKey & opEvent in Audit Events search lets an admin with adequate entitlements execute arbitrary SQL. Check your Syncope deployments. #cybersecurity #ciso #apache #vulnerabilities #msp https://secalerts.co/vulnerability/CVE-2026-77051?utm_campaign=x https://t.co/UH79wOJ3Fr
Post summary
The tweet announces CVE‑2026‑77051, a critical SQL injection in Apache Syncope (CVSS 9.8) that lets privileged admins execute arbitrary SQL via unsanitized fields, and urges checking deployments.
0000085
888 followersView on X

Explore more

Back to dashboard