Loading vulnerability…
XXE in Apache Syncope Console Keymaster Parameter Handling
CVE-2026-23795 is an XML External Entity (XXE) vulnerability in Apache Syncope Console caused by improper restriction of XML external entity references during processing of Keymaster parameters. An administrator with sufficient entitlements to create or edit Keymaster parameters through the Console can supply crafted malicious XML that is parsed in a way that permits external entity resolution. This can expose sensitive information from the underlying system or other reachable resources. The issue affects Apache Syncope Console versions 3.0 through 3.0.15 and 4.0 through 4.0.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in sensitive data disclosure. Depending on parser behavior and deployment context, the XXE condition may allow disclosure of local files accessible to the application, retrieval of data from internal network resources, and exposure of sensitive configuration or authentication-related material processed by the identity management platform.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict Syncope Console access to only highly trusted administrators, minimize the number of accounts entitled to create or edit Keymaster parameters, and avoid accepting or reusing untrusted XML content in that workflow. Additional monitoring around suspicious XML parsing behavior and unusual outbound requests from the application can help detect attempted exploitation, but these measures do not replace upgrading.
Patch, then assume compromise.
Upgrade Apache Syncope to a fixed release. Apache states that the issue is resolved in versions 3.0.16 and 4.0.4. Deployments on affected 3.0.x and 4.0.x releases should be updated to those versions or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.