Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-114364— Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search

Quick assessment

Affected

Apache Software Foundation Apache Syncope

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Syncope 中存在 SQL 注入漏洞（即 SQL 命令中特殊元素未得到正确中和）。本 CVE 涉及对 CVE-2026-77051 的修复不完整问题：具备相应权限的管理员可利用未经净化的 opEvent 参数，通过堆叠查询执行任意 SQL 语句。参考链接：https://cve.org/CVERecord?id=CVE-2026-77051 受影响版本包括： Apache Syncope 3.0.0-M0 至 3.0.16 Apache Syncope 4.0.0-M0 至 4.0.8 Apa

AI Predicted 9.8 Difficulty: Easy Updated Nov 02, 2026

Possible ATT&CK Techniques 2 AI

T1069 · Permission Groups Discovery T1190 · Exploit Public-Facing Application

Updated Nov 02, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search

Source: CVE Program / CVE List V5

Vulnerability Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters. Reference: https://cve.org/CVERecord?id=CVE-2026-77051 This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Syncope	3.0.0-M0 ~ 3.0.16	-

II. Public POCs for CVE-2026-114364

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-114364

请登录查看更多情报信息。

Other References for CVE-2026-114364 (1)

https://lists.apache.org/thread.html/j65oo441q5gpr4d0ljb644r9mdro2slm vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-114364

Same Patch Batch · Apache Software Foundation · 2026-11-02 · 6 CVEs total

CVE-2026-111959		Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
CVE-2026-113687		Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
CVE-2026-113511		Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
CVE-2026-110535		Apache Syncope: AuthProfile value escalation via self-service update
CVE-2026-109083		Apache Syncope: Remote Code Execution via Flowable JUEL expression

IV. Related Vulnerabilities

Same product: Apache Syncope

Same vendor: Apache Software Foundation

Same weakness: CWE-89