Apache Syncope admin-level SQL injection
SQL injection in Apache Syncope allows an administrator with adequate entitlements to execute arbitrary SQL commands against the configured relational database backend.
- Vendor
- Apache
- Product
- Syncope
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.6%
- Status
- patched
- Published
Is CVE-2026-82232 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-82232 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.6% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-82232 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Apache Syncope contains a SQL injection path accessible to administrators holding adequate entitlements. An administrator exploiting this flaw can execute arbitrary SQL statements against the underlying relational database.
The access requirement is higher than the unauthenticated or low-privilege injection paths in the same patch batch (see CVE-2026-73579). However, admin-level SQL execution in an identity governance platform puts the full credential store at risk.
Patch via the Apache Software Foundation advisory. See the full Syncope patch article for patch priority order across all seven CVEs.
Other Apache CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2016-3081 Apache Struts Command Injection Vulnerability | [ HIGH ] | 8.1 | 96.9% | |
| CVE-2026-87802 Apache Syncope SRA allows JWT forgery without JWKS URIwrite-up | [ CRITICAL ] | 9.1 | 0.3% | — |
| CVE-2026-87785 Apache Syncope JWT authentication bypass via JWKS spoofingwrite-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-86460 Apache Syncope Cypher injection via Neo4j FIQL searchwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-73668 Apache Syncope admin REST API exposes connector credentialswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73579 Apache Syncope search injection via FIQL to SQL/Neo4j/Elasticsearchwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73470 Apache Syncope improper privilege management in delegationswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | [ HIGH ] | 7.5 | 98.5% |
