Flexense SyncBreeze – Unauthenticated Remote Code Execution (0DAY-2025-0002)
In May 2026, SyncBreeze released an update that silently patched a critical vulnerability. The vulnerability was an authentication bypass allowing arbitrary file operations, but when chained with another persistent flaw, it enables logical RCE with SYSTEM privileges. This exploit chain was provided as part of our n-day feed, and now that it has been patched, we can finally disclose it.
SyncBreeze
SyncBreeze is a fast, powerful and reliable file synchronization solution for local disks, network shares, NAS storage devices and enterprise storage systems. Users are provided with multiple one-way and two-way file synchronization modes, periodic file synchronization, real-time file synchronization, bit-level file synchronization, multi-stream file synchronization, background file synchronization and much more.
It features both server and client applications. The client application allows users to configure the server, check statistics, and more.
The vulnerability
A logical vulnerability allows unauthorized clients to enumerate, download, upload, and delete files on the target system with SYSTEM privileges.
The libpal!SCA_NetServerAgent::ThreadFunc function is responsible for receiving and processing messages from clients. It retrieves messages using the libpal!SCA_NetTransport::WaitForMessage function in the form of an SCA_NetMessage structure. One field in this structure is command. If the command value is between 2 and 10, the libpal!SCA_NetServerAgent::ExecuteInternalCommand function is called.
This function can execute several commands, mostly related to file operations.
Critically, there are no authorization checks within these functions. This allows unauthorized access to the target system’s file system. Since the service runs with SYSTEM privileges, all operations are performed with those same privileges.
Exploitation
While we have file system access, we cannot directly execute commands.
Trigger
We discovered that administrators can create a “Space Monitor” that triggers on certain events. When triggered, it can execute a command.
With the configuration shown above, the command runs immediately.
However, this feature is only available to authorized users.
An Additional Flaw
With file system access, we can locate where the server stores its configuration, including usernames and passwords. Specifically, there is a file at C:\Program Files\Sync Breeze Enterprise\config\syncbreezeent.flx that contains this data. Using the first vulnerability, we can download this file to extract the configuration.
While the file is encrypted with a hardcoded password, the credentials inside are stored in cleartext.
Chaining the Exploits
The complete exploitation strategy is as follows:
- Use file system access to download the configuration file;
- Extract credentials from the configuration file;
- Log in with the extracted credentials;
- Create a “Space Monitor” that triggers immediately;
- Execute arbitrary commands with SYSTEM privileges.
Exploit Development
Communication
To avoid redeveloping communication functions, we leveraged libraries from the original software that contain functions for both the server and client sides.
*In the POC code, the necessary functions are imported from these libraries. Since some functions are not exported, the exploit uses hardcoded offsets and depends on the libraries included with the POC. If you update the libraries, you must also update the exploit code in the syncbreeze.c file.
Space Monitors
If a “Space Monitor” with the same configuration already exists on the server, creation will fail. To prevent this, the POC first checks for any existing “Space Monitor” on the C:\ drive and deletes it if found, then creates a new one with our command.
POC
The POC can be executed with just the target IP address and a command. As always it can be downloaded from our GitHub repo.
However, if you already have a configuration file with credentials, you can specify it instead of downloading it from the target. Similarly, you can provide credentials directly to the POC to skip the config download step.
Your command executes with SYSTEM privileges.
The POC searches for the config file in the default paths, but you can also specify a custom path using the “rconfig” option.
Limitations
A process created by a “Space Monitor” must finish before the next one can start. Tasks are queued, and the system cannot execute the next task until the current one completes.
The Patch
Version 18.1.26 (released in May 2026) added authorization checks that prevent unauthorized execution of internal commands. This prevents the download of the configuration file and blocks credential extraction:
However, the configuration file still stores credentials in cleartext. If an attacker obtains the file through other means, they can extract and use those credentials, or conduct credential spraying attacks.
