{"basis":"claimed","id":"CVE-2026-113687","name":"Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass","vendorProject":"Apache Software Foundation","product":"Apache Syncope","publishedAt":"2026-11-02","cvss":null,"exploited":null,"epss":null,"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass","description":"Improper isolation or compartmentalization vulnerability in Apache Syncope.\n\n\n\nAn administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox.\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.","cwes":["CWE-653"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:17:16.933Z","cvssVector":null,"ssvc":null,"measured":[],"social":{"total":2,"first_seen":"2026-11-02T19:15:22.882Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":2}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/SecNews_GR/status/2117347727243710735","author":"SecNews_GR","author_name":"SecNews","avatar_url":"https://pbs.twimg.com/profile_images/1093129693895839747/4FEthZtl_bigger.jpg","text":"CVE-2026-113687: Δύο νέες ευπάθειες RCE στο Apache Syncope\nhttps://t.co/Dn3PyHeNE7","engagement":2,"posted_at":"2026-11-02T20:06:51.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/infosec.skyfleet.blue/post/ass64fuaenb25","author":"infosec.skyfleet.blue","author_name":"InfoSec","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:tcyv5gk43e5gekr5wo3vglhl/bafkreibpnoilqgb25bht7b2pineff2gldhhkn6qc2xhqbsb5m7pzhf7bju","text":"CVE-2026-113687: Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass","engagement":0,"posted_at":"2026-11-02T19:15:22.882Z"}],"exploit_repositories":[]}}