CVE-2026-53421: syncope from 3.0.0 (inclusive), through 3.0.16 (inclusive), from 4.0.0 (inclusive), before 4.0.7 (exclusive), from…

Affected technology

syncope · from 3.0.0 (inclusive), through 3.0.16 (inclusive)
apache

syncope · from 4.0.0 (inclusive), before 4.0.7 (exclusive)
apache

syncope · from 4.1.0 (inclusive), before 4.1.2 (exclusive)
apache

Apache Syncope · 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1
Apache Software Foundation

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could run code remotely. Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.