Do Son The ASF patched Apache security vulnerabilities with new Apache security fixes for Syncope, Arrow, and Fineract, including critical flaw CVE-2026-64618.
Apache Syncope
Six Apache Syncope vulnerabilities, including CVE-2026-82232, expose severe identity management flaws. Patch your Apache Syncope servers immediately.
Apache Syncope CVE-2025-57738 allows root RCE via unsandboxed Groovy. Technical details and PoC are now public. Upgrade to v3.0.14 or 4.0.2 immediately.
Apache patches XSS (CVE-2026-23794) & XXE flaws in Syncope. Vulnerability allows session hijacking via login page. Update to v3.0.16 or v4.0.4 now.
Apache warned of a Critical flaw (CVE-2025-65998) in Syncope. When AES is enabled for password storage, a hard-coded key allows attackers with database access to decrypt all user passwords. Update immediately.