Is CVE-2026-113687 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113687 being exploited in the wild.

How severe is CVE-2026-113687?

Informational severity, published 2 November 2026.

Which products and versions are affected?

Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3.

Is there a fix for CVE-2026-113687?

Yes: fixed in Apache Syncope 4.0.9, 4.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113687 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-113687?

Check whether you run Apache Syncope at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113687: Apache Syncope improper sandbox isolation in Groovy

CVE-2026-113687 · Severity: info · Published 2026-11-02

Apache Syncope is an identity and access management platform that allows administrators to manage user identities and access rights. An attacker with administrator credentials can create malicious Groovy code that executes on a separate thread, bypassing security restrictions designed to prevent untrusted code execution. This could allow an attacker to gain arbitrary code execution on the system hosting Syncope.

Technologies: Apache Syncope. Vendors: Apache.

Quick answers

Is CVE-2026-113687 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113687 being exploited in the wild.
How severe is CVE-2026-113687?: Informational severity, published 2 November 2026.
Which products and versions are affected?: Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3.
Is there a fix for CVE-2026-113687?: Yes: fixed in Apache Syncope 4.0.9, 4.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113687 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-113687?: Check whether you run Apache Syncope at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache Syncope 4.0.9, 4.1.4

Technical details

The vulnerability is an improper isolation or compartmentalization flaw in Apache Syncope's Groovy code execution sandbox. An authenticated administrator with sufficient privileges can craft a malicious Groovy class that runs on a separate thread, circumventing the security sandbox that normally restricts what untrusted code can do. This allows arbitrary code execution with the privileges of the Syncope process.

Affected products

Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3

Timeline

2026-11-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.