https://seclists.org/oss-sec/2026/q3/183: CVE-2026-63071: Apache Syncope: RCE via Groovy Sandbox bypass
Published Jul 20, 2026
·Updated
Affected Software
3 affected components
Apache Syncope>=3.0.0-M0<=3.0.16
Apache Syncope>=4.0.0-M0<=4.0.6
Apache Syncope>=4.1.0-M0<=4.1.1
Frequently Asked Questions
1
What is the severity of CVE-2026-63071?
CVE-2026-63071 has a moderate severity level.
2
Which versions of Apache Syncope are affected by CVE-2026-63071?
Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 are affected by CVE-2026-63071.
3
How can I fix CVE-2026-63071?
To mitigate CVE-2026-63071, upgrade to a non-affected version of Apache Syncope.
4
What type of vulnerability is CVE-2026-63071?
CVE-2026-63071 is a Remote Code Execution (RCE) vulnerability due to a Groovy Sandbox bypass.
5
When was CVE-2026-63071 published?
CVE-2026-63071 was published on July 20, 2026.