CVE-2025-57738: Apache Syncope: Remote Code Execution by delegated administrators

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 23.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-20 · updated 2026-10-08
Weakness: CWE-653

Description

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.

Affected products

Apache Software Foundation Apache Syncope: from 2.1.0 before 3.0.14; from 4.0.0 before 4.0.2 — fixed in 3.0.14, 4.0.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Syncope 3.0.14, 4.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-57738 or the next vulnerability affects your stack