CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs

As cited

Copy frozen at 2026-09-14 20:02 UTC (site build).

vulnerabilities

CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs

CVE-2026-77147 affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, stemming from improper control of code generation that enables Groovy sandbox escape when CommandArgs is empty. The vulnerability carries important severity and requires administrator privileges to exploit.

Why it matters: Syncope administrators and organizations running affected versions need to patch immediately, as this code injection flaw allows authenticated admins to bypass sandbox protections and potentially execute arbitrary code.

Source published

2026-09-14 15:43 UTC

First seen by Cybersecurity Tracker

2026-09-14 19:35 UTC