InfoSec Signals™
Sign InStart Free
Back to CVE records
High 8.4Published Sep 3, 2026

CVE-2025-12737Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

Updated under an hour ago ()

Does this affect you?

It affects WSO2 Open Banking AM and 7 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

CVSS
8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-78
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
WSO2
NVD analysis
Analyzed
Record last updated
Sep 3, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
WSO2 WSO2 Open Banking AM
wso2:open_banking_am (from the name)
before 2.0.0 status unknown; from 2.0.0 before 2.0.0.398
CNA record
WSO2 WSO2 Open Banking IAM
wso2:open_banking_iam (from the name)
before 2.0.0 status unknown; from 2.0.0 before 2.0.0.418
CNA record
WSO2 WSO2 Traffic Manager
wso2:traffic_manager (from the name)
from 4.5.0 before 4.5.0.34; from 4.6.0 before 4.6.0.1
CNA record
WSO2 WSO2 Universal Gateway
wso2:universal_gateway (from the name)
from 4.5.0 before 4.5.0.34; from 4.6.0 before 4.6.0.1
CNA record
WSO2 WSO2 API Control Plane
wso2:api_control_plane (from the name)
from 4.5.0 before 4.5.0.36; from 4.6.0 before 4.6.0.1
CNA record
WSO2 WSO2 API Manager
wso2:api_manager (from the name)
before 3.1.0 status unknown; from 3.1.0 before 3.1.0.349; from 3.2.0 before 3.2.0.453; from 3.2.1 before 3.2.1.73; from 4.0.0 before 4.0.0.373; from 4.1.0 before 4.1.0.236; from 4.2.0 before 4.2.0.176; from 4.3.0 before 4.3.0.88; and 3 more ranges
CNA record
WSO2 WSO2 Identity Server as Key Manager
wso2:identity_server_as_key_manager (from the name)
before 5.10.0 status unknown; from 5.10.0 before 5.10.0.369
CNA record
WSO2 WSO2 Identity Server
wso2:identity_server (from the name)
before 5.10.0 status unknown; from 5.10.0 before 5.10.0.378; from 5.11.0 before 5.11.0.425; from 6.0.0 before 6.0.0.252; from 6.1.0 before 6.1.0.253; from 7.0.0 before 7.0.0.130; from 7.1.0 before 7.1.0.38; from 7.2.0 before 7.2.0.1
CNA record
wso2 api_control_plane
wso2:api_control_plane
from 4.5.0 before 4.5.0.36; 4.6.0
NVD
wso2 api_manager
wso2:api_manager
from 3.1.0 before 3.1.0.349; from 3.2.0 before 3.2.0.453; from 3.2.1 before 3.2.1.73; from 4.0.0 before 4.0.0.373; from 4.1.0 before 4.1.0.236; from 4.2.0 before 4.2.0.176; from 4.3.0 before 4.3.0.88; from 4.4.0 before 4.4.0.52; and 2 more ranges
NVD

References

References

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.