Public PoC and Technical Details Disclosed for Apache Syncope RCE

SecureLayer7 disclosed CVE-2025-57738: a high-severity RCE in Apache Syncope where uploaded Groovy implementations are compiled with an unsandboxed GroovyClassLoader, allowing static initializers to execute arbitrary JVM code (including Runtime.exec and ProcessBuilder). A public PoC demonstrates root-level execution in a Docker deployment; the vendor mitigation is to upgrade to Syncope 3.0.14 or 4.0.2.