Apache Syncope RCE Vulnerability Detailed After Public Exploit Code Release

Security researchers disclosed CVE-2025-57738, a high-severity (CVSS 7.2) remote code execution vulnerability in Apache Syncope's Groovy-based ImplementationManager that allows authenticated administrators to upload malicious Groovy classes which execute at compile time and can invoke full JVM APIs—leading to full system compromise in containerized/root deployments; a public PoC was published and Syncope 3.0.14 / 4.0.2 contain fixes that implement a Groovy sandbox and API blacklists, so affected deployments should upgrade and audit privileged accounts immediately.