CVE-2026-57308: syncope-core · Improper Neutralization of Special Elements Used
Affects syncope-coreSource GCVE Database
Not known to be exploited · CVSS 9.8 Critical · fixed in 4.0.7 : patch syncope-core as a priority.
Data as of 26 Oct 2026, 09:16 UTC
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 57% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 4.0.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitation evidence
Disclosed: evidence found.
CVE published 20 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Mavenorg.apache.syncope/syncope-corepkg:maven/org.apache.syncope/syncope-coreOther threats | Affected– | Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade affected Apache Syncope versions to 4.0.7 or 4.1.2 where the vulnerability is fixed. No other mitigation or temporary workaround is indicated.
Description
Apache Syncope contains a critical SQL Injection vulnerability (CVE-2026-57308) that allows an administrator with sufficient privileges to execute arbitrary SQL commands via unsanitized sort parameters. This vulnerability affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue is fixed in versions 4.0.7 and 4.1.2. Users should upgrade to these fixed versions to remediate the vulnerability.