Apache Syncope Cypher injection via Neo4j FIQL search
Cypher injection in Apache Syncope's Neo4j persistence layer via FIQL search conditions. Affects 3.0.0-M0 through 3.0.16 and the 4.x branch. Authenticated attackers with search access can inject arbitrary Cypher queries.
- Vendor
- Apache
- Product
- Syncope
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.6%
- Status
- patched
- Published
Is CVE-2026-86460 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-86460 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.6% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-86460 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
When Apache Syncope is deployed with a Neo4j persistence backend, FIQL (Feed Item Query Language) search conditions are passed into the Cypher query engine without adequate sanitization. An authenticated user with search access can inject arbitrary Cypher statements.
Affected versions span 3.0.0-M0 through 3.0.16 and the 4.x branch. The broader search injection issue affecting all backends is tracked as CVE-2026-73579; this CVE specifically covers the Neo4j/Cypher layer.
The Apache Software Foundation released a patch. See the advisory and the Apache Syncope patch article for patch priority guidance.
Other Apache CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2016-3081 Apache Struts Command Injection Vulnerability | [ HIGH ] | 8.1 | 96.9% | |
| CVE-2026-87802 Apache Syncope SRA allows JWT forgery without JWKS URIwrite-up | [ CRITICAL ] | 9.1 | 0.3% | — |
| CVE-2026-87785 Apache Syncope JWT authentication bypass via JWKS spoofingwrite-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-82232 Apache Syncope admin-level SQL injectionwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-73668 Apache Syncope admin REST API exposes connector credentialswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73579 Apache Syncope search injection via FIQL to SQL/Neo4j/Elasticsearchwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73470 Apache Syncope improper privilege management in delegationswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | [ HIGH ] | 7.5 | 98.5% |
