CVE-2026-77147
Deferred Deferred - Pending Action

Code Injection in Apache Syncope

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-77147
EUVD
EUVD-2026-77457

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
apache syncope From 3.0.0-M0 (inc) to 3.0.16 (inc)
apache syncope From 4.0.0-M0 (inc) to 4.0.7 (inc)
apache syncope From 4.1.0-M0 (inc) to 4.1.2 (inc)
apache syncope 4.0.8
apache syncope 4.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a code injection vulnerability in Apache Syncope where an administrator with sufficient permissions can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation. This bypasses the Groovy security sandbox, allowing arbitrary code execution.

Detection Guidance

Detecting this vulnerability requires checking Apache Syncope versions and reviewing Groovy Command class implementations for untrusted code. Check installed versions with commands like 'syncopectl status' or by examining version files in the Syncope installation directory. Review CommandArgs implementations for suspicious Groovy code in static methods.

Impact Analysis

An attacker with administrator privileges could exploit this to execute arbitrary code on the system, potentially leading to data breaches, system compromise, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's security rules for protected health information. Compliance could be compromised if sensitive data is exposed.

Mitigation Strategies

Immediately upgrade Apache Syncope to version 4.0.8 or 4.1.3 or later. Review and remove any unauthorized Groovy Command classes containing untrusted code. Restrict administrator entitlements to only necessary users. Monitor for unusual activity in Syncope logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77147. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart