What’s Vulnerable › Vulnerabilities
CVE-2025-5717: Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-23 · updated 2026-10-18
- Weakness: CWE-94
Description
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server. Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users.
Affected products
- WSO2 Api Control Plane: 4.5.0
- WSO2 API Manager: 3.0.0, 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.1.0 (+4)
- WSO2 Open Banking Am: 2.0.0
- WSO2 Traffic Manager: 4.5.0
References
Get alerted when CVE-2025-5717 or the next vulnerability affects your stack