Apache fixes eight high risk flaws across three projects

Apache Software Foundation has released security fixes on 2 November 2026 addressing eight high‑risk vulnerabilities across three core projects: Apache Syncope, Apache Fineract, and Apache Arrow. The most severe flaw is CVE-2026-64618, with a CVSS v3 score of 9.8 (Critical), which permits remote, unauthenticated SQL injection via the advanced search API endpoint. The advisory notes that no active exploitation in the wild has been confirmed at this time.

Notable vulnerabilities include CVE-2026-64618 in Apache Fineract, CVE-2026-113687 and CVE-2026-114364 in Apache Syncope, and CVE-2026-111959 in Apache Arrow Rust. The Fineract issues involve SQL injection tied to an input validation bypass, while Syncope entries describe sandbox escapes, stacked SQL injection, unauthorized realm tree moves and process execution flaws that could bypass server access controls.

The Arrow Rust flaw involves an out‑of‑bounds read caused by improper validation of RunEndEncoded arrays in ArrayData. Collectively, these flaws impact specific version ranges: Fineract up to 1.15.0, Syncope 3.0.0–3.0.16, 4.0.0–4.0.8 and 4.1.0–4.1.3, and Arrow Rust 33.0.0–60.0.0.

Patches have been released: Apache Fineract upgrade to 1.16.1, Apache Syncope to 4.0.9 or 4.1.4, and Apache Arrow to 60.1.0. The advisories warn that these fixes should be applied promptly to mitigate potential impact.