> CVE-2026-77147

« BACK_TO_HOME
PUBLISHED
2026-09-14 13:18
MODIFIED
2026-09-14 13:18
EPSS (Prob. Exploit)
0.45%
Top 61.8%
DATA SOURCES:
NVD 🔗 2026-09-14 CWE MITRE 🔗 2026-10-01 FIRST EPSS 🔗 2026-10-25

> DESCRIPTION

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-94

> CWE DETAILED DESCRIPTIONS

CWE-94: Improper Control of Generation of Code ('Code Injection') - The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

> HISTORIQUE DES MODIFICATIONS

Première apparition
14/09/2026 13:18
Source: NVD
📊 ENRICHISSEMENT 01/10/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-94: Improper Control of Generation of Code ('Code Injection') - The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not n...
Total des modifications: 1 Dernière mise à jour: 3 weeks ago

> REFERENCES

https://lists.apache.org/thread/qr464o2lyj3rxp8b0q25ssn0qwjxyrgz
« BACK_TO_HOME