Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WSO2 | WSO2 Open Banking AM | unaffected |
|
||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Open Banking IAM | unaffected |
|
||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Traffic Manager | unaffected |
|
||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Universal Gateway | unaffected |
|
||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 API Control Plane | unaffected |
|
||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 API Manager | unaffected |
|
||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Identity Server as Key Manager | unaffected |
|
||||||||||||||||||||||||||||||||||||
| WSO2 | WSO2 Identity Server | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/#solution
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 03 Sep 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 03 Sep 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system. | |
| Title | Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution | |
| First Time appeared |
Wso2
Wso2 wso2 Api Control Plane Wso2 wso2 Api Manager Wso2 wso2 Identity Server Wso2 wso2 Identity Server As Key Manager Wso2 wso2 Open Banking Am Wso2 wso2 Open Banking Iam Wso2 wso2 Traffic Manager Wso2 wso2 Universal Gateway |
|
| Weaknesses | CWE-78 | |
| CPEs | cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
|
| Vendors & Products |
Wso2
Wso2 wso2 Api Control Plane Wso2 wso2 Api Manager Wso2 wso2 Identity Server Wso2 wso2 Identity Server As Key Manager Wso2 wso2 Open Banking Am Wso2 wso2 Open Banking Iam Wso2 wso2 Traffic Manager Wso2 wso2 Universal Gateway |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: WSO2
Published:
Updated: 2026-09-03T13:34:31.346Z
Reserved: 2025-11-05T03:08:36.082Z
Link: CVE-2025-12737
Vulnrichment
Updated: 2026-09-03T13:34:28.139Z
NVD
Status : Received
Published: 2026-09-03T14:17:00.183
Modified: 2026-09-03T14:17:00.183
Link: CVE-2025-12737
Redhat
No data.
OpenCVE Enrichment
No data.