What’s Vulnerable › Vulnerabilities
CVE-2025-12737: Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
- Severity: high (CVSS 8.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-03 · updated 2026-10-19
- Weakness: CWE-78
Description
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
Affected products
- WSO2 Api Control Plane: from 4.5.0 before 4.5.0.36; 4.6.0 — fixed in 4.5.0.36
- WSO2 API Manager: from 3.1.0 before 3.1.0.349; from 3.2.0 before 3.2.0.453; from 3.2.1 before 3.2.1.73; from 4.0.0 before 4.0.0.373; from 4.1.0 before 4.1.0.236; from 4.2.0 before 4.2.0.176 — fixed in 3.1.0.349, 3.2.0.453, 3.2.1.73, 4.0.0.373, 4.1.0.236, 4.2.0.176
- WSO2 Identity Server: from 5.10.0 before 5.10.0.378; from 5.11.0 before 5.11.0.425; from 6.0.0 before 6.0.0.252; from 6.1.0 before 6.1.0.253; from 7.0.0 before 7.0.0.130; from 7.1.0 before 7.1.0.38 — fixed in 5.10.0.378, 5.11.0.425, 6.0.0.252, 6.1.0.253, 7.0.0.130, 7.1.0.38
- WSO2 Identity Server As Key Manager: from 5.10.0 before 5.10.0.369 — fixed in 5.10.0.369
- WSO2 Open Banking Am: from 2.0.0 before 2.0.0.398 — fixed in 2.0.0.398
- WSO2 Open Banking Iam: from 2.0.0 before 2.0.0.418 — fixed in 2.0.0.418
- WSO2 Traffic Manager: from 4.5.0 before 4.5.0.34; 4.6.0 — fixed in 4.5.0.34
- WSO2 Universal Gateway: from 4.5.0 before 4.5.0.34; 4.6.0 — fixed in 4.5.0.34
How to fix
Upgrade to a fixed version: WSO2 Api Control Plane 4.5.0.36; WSO2 API Manager 3.1.0.349, 3.2.0.453, 3.2.1.73, 4.0.0.373; WSO2 Identity Server 5.10.0.378, 5.11.0.425, 6.0.0.252, 6.1.0.253; WSO2 Identity Server As Key Manager 5.10.0.369; WSO2 Open Banking Am 2.0.0.398; WSO2 Open Banking Iam 2.0.0.418; WSO2 Traffic Manager 4.5.0.34; WSO2 Universal Gateway 4.5.0.34. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-12737 or the next vulnerability affects your stack