CVE-2025-12737

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

HIGH

8.4

CVSS Score

Published: September 3, 2026 at 01:02 PM UTC

Updated: October 19, 2026 at 10:10 PM UTC

8 products affected across 1 vendorAPI ManagerIdentity ServerIdentity Server As Key Manager

Using WSO2 Open Banking AM by WSO2?

Get instant alerts when new vulnerabilities affect WSO2 Open Banking AM - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.4

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

API Control Plane · WSO2

95%

4.5.0 ≤ v < 4.5.0.364.5.0 4.6.0

Affected range stops below 4.5.0.36, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.6.0.1, so it looks safe — our inference, not a vendor statement

API Manager · WSO2

95%

3.1.0 ≤ v < 3.1.0.3493.2.0 ≤ v < 3.2.0.4533.2.1 ≤ v < 3.2.1.734.0.0 ≤ v < 4.0.0.3734.1.0 ≤ v < 4.1.0.2364.2.0 ≤ v < 4.2.0.1764.3.0 ≤ v < 4.3.0.884.4.0 ≤ v < 4.4.0.524.5.0 ≤ v < 4.5.0.353.2.0 3.2.1 4.0.0 4.1.0 4.2.0 4.3.0 4.4.0 4.5.0 4.6.0

Affected range stops below 3.1.0.349, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.2.0.453, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.2.1.73, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.0.0.373, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.1.0.236, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.2.0.176, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.3.0.88, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.0.52, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5.0.35, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.6.0.1, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 3.1.0 (unknown)

Identity Server · WSO2

95%

5.10.0 ≤ v < 5.10.0.3785.11.0 ≤ v < 5.11.0.4256.0.0 ≤ v < 6.0.0.2526.1.0 ≤ v < 6.1.0.2537.0.0 ≤ v < 7.0.0.1307.1.0 ≤ v < 7.1.0.385.11.0 6.0.0 6.1.0 7.0.0 7.1.0 7.2.0

Affected range stops below 5.10.0.378, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.11.0.425, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.0.0.252, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.1.0.253, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.0.0.130, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.1.0.38, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.2.0.1, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.10.0 (unknown)

Identity Server As Key Manager · WSO2

95%

5.10.0 ≤ v < 5.10.0.3695.10.0

Affected range stops below 5.10.0.369, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.10.0 (unknown)

Open Banking Am · WSO2

95%

2.0.0 ≤ v < 2.0.0.3982.0.0

Affected range stops below 2.0.0.398, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 2.0.0 (unknown)

Open Banking IAM · WSO2

95%

2.0.0 ≤ v < 2.0.0.4182.0.0

Affected range stops below 2.0.0.418, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 2.0.0 (unknown)

Traffic Manager · WSO2

95%

4.5.0 ≤ v < 4.5.0.344.5.0 4.6.0

Affected range stops below 4.5.0.34, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.6.0.1, so it looks safe — our inference, not a vendor statement

Universal Gateway · WSO2

95%

4.5.0 ≤ v < 4.5.0.344.5.0 4.6.0

Affected range stops below 4.5.0.34, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.6.0.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/

References (1)

Vendor AdvisoryPatch

Source: cverecord

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.4HIGHWSO2

Attack Vector: ADJACENT_NETWORK
Complexity: LOW
Privileges: HIGH
User Interaction: NONE
Scope: CHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-78

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card