CVE-2026-86460

published 2026-09-14

CVE-2026-86460: Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0…

Priority P2 60 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache_software_foundation	apache_syncope	3.0.0-M0 – 3.0.16	—
apache_software_foundation	apache_syncope	4.0.0-M0 – 4.0.7	—
apache_software_foundation	apache_syncope	4.1.0-M0 – 4.1.2	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89