CVE-2025-57738highCWE-653

CVE-2025-57738: high-severity vulnerability in Apache Syncope

Apache Syncope: Remote Code Execution by delegated administrators

Published · Updated

Follow this CVE+ Monitor Apache Syncope+ Monitor org.apache.syncope.core:syncope-core-spring

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

26Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 24%
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Syncope
Related CVEs — Apache Syncope

In the same product, most dangerous first.

CVE-2018-1322—CVE-2018-1322EPSS 19.9%CVE-2018-1321—CVE-2018-1321EPSS 17.5%CVE-2018-17186—CVE-2018-17186EPSS 2.5%CVE-2026-23795MEDIUMApache Syncope: Console XXE on Keymaster parametersEPSS 2.0%CVE-2018-17184—CVE-2018-17184EPSS 1.2%CVE-2026-53421CRITICALApache Syncope: Remote Code Execution via Scripted ConnectorEPSS 1.1%