CVE-2026-53405: Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-20 · updated 2026-10-24
Weakness: CWE-653

Description

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.

Affected products

Apache Software Foundation Apache Syncope: from 3.0.0 through 3.0.16; from 4.0.0 before 4.0.7; from 4.1.0 before 4.1.2 — fixed in 4.0.7, 4.1.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Syncope 4.0.7, 4.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-53405 or the next vulnerability affects your stack