Loading story…
Apache disclosed CVE-2026-56287, an important-severity vulnerability in Apache Fineract that allows an authenticated user to exploit the Client Search API through insufficient validation of the orderBy and sortOrder parameters in GET /api/v1/clients. The flaw affects Fineract 1.14.0 and earlier affected releases, while 1.15.0 is listed as unaffected. An attacker must have permission to view clients to trigger the issue.
Successful exploitation can enable blind boolean-based SQL injection for arbitrary data extraction, and in deployments using MySQL or MariaDB, it can also expose local files via the database LOAD_FILE() function. Apache Fineract, a platform used for digital financial services, advised users to upgrade to a fixed release to mitigate the risk of database compromise and local file disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In the disclosure, Apache stated that Fineract 1.15.0 is unaffected by CVE-2026-56287 and advised users to upgrade to a fixed version. This establishes the remediation guidance associated with the vulnerability announcement.
Apache disclosed CVE-2026-56287, an important-severity boolean-based SQL injection vulnerability in Apache Fineract's GET /api/v1/clients endpoint. The flaw affects Apache Fineract 1.14.0 and earlier affected releases and can allow blind boolean-based data extraction and, on MySQL or MariaDB, local file disclosure via LOAD_FILE().
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Syncope disclosed **CVE-2026-57308**, an important SQL injection vulnerability in the Audit Events search functionality that can let an authenticated administrator with sufficient entitlements execute arbitrary SQL through stacked queries. The issue is caused by improper neutralization of special elements in SQL commands, specifically unsanitized `sort` parameters handled by the application. The vulnerability affects Apache Syncope versions `3.0.0-M0` through `3.0.16`, `4.0.0-M0` through `4.0.6`, and `4.1.0-M0` through `4.1.1`. Apache advised users to upgrade to **4.0.7** or **4.1.2** to remediate the flaw, and credited **Lennart Hostettler** with reporting the issue.
Jul 20, 2026
Apache disclosed **CVE-2026-35194**, a critical remote code execution flaw in Apache Flink that allows authenticated users with query submission privileges to run arbitrary code on **TaskManager** nodes. The vulnerability is caused by improper escaping of user-controlled input during Flink’s SQL code-generation process, where malicious SQL can be translated into attacker-controlled Java code. Apache said the issue affects Flink `1.15.0` through `1.20.x` before `1.20.4`, and `2.0.0` through `2.x` before `2.0.2`, `2.1.2`, and `2.2.1`. The flaw impacts JSON functions introduced in `1.15.0` and `LIKE` expressions with `ESCAPE` clauses introduced in `1.17.0`, creating a serious risk for multi-tenant and shared environments where non-administrative users may be able to escalate access, manipulate data, compromise clusters, and move laterally. Apache credited Yaswant Katakam of Confluent InfoSec for reporting the bug, while public disclosure also highlighted the danger of SQL-to-Java code translation paths in Flink’s engine. Organizations were urged to upgrade immediately to the patched releases.
Jun 29, 2026
Apache released security updates for its Syncope identity and access management platform to fix multiple vulnerabilities across the 3.0, 4.0, and 4.1 branches, including remote code execution, SQL injection, privilege escalation, SSRF, information disclosure, XXE, XSS, and cryptographic weaknesses. The most severe issues include several Groovy-related post-authentication RCE flaws, while `CVE-2026-57308` affects Audit Events search through an unsanitized sort parameter that can enable authenticated SQL injection, and `CVE-2026-62183` can let a regular user elevate privileges through certain self-service workflow configurations and obtain administrator-level entitlements. Affected releases include Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 for the newly disclosed SQL injection and privilege escalation bugs, with Apache delivering fixes in versions **4.0.7** and **4.1.2** and noting that some older flaws were addressed in earlier point releases such as **4.1.1**, **4.0.6**, **4.0.4**, **4.0.3**, **3.0.16**, and **3.0.15**. Apache said binary hotfixes are not available, requiring organizations to upgrade or rebuild from patched source, and urged administrators to review roles, entitlements, and self-service workflows; no public exploitation has been confirmed.
Jul 24, 2026