CVE-2026-53405 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask

Critical 9.8 Published 20 Jul 2026 Updated 21 Jul 2026

Administrators can execute arbitrary code on the server by importing and starting BPMN processes containing unsandboxed Groovy scripts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-53405?

CVE-2026-53405 is a critical code injection vulnerability in Apache Syncope, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Isolation or Compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.

Weakness: CWE-653

Which versions are affected by CVE-2026-53405?

It affects 1 product.

Products include Apache Syncope.

How do I fix CVE-2026-53405?

No fix has been published for CVE-2026-53405 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-53405 being exploited?

There is no known exploitation of CVE-2026-53405 in the wild and no public exploit code.

Sources

Also known as GHSA-xvr8-rwv3-hv45.