CVE-2025-12737: Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

DescriptionCVE.org

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

• WSO2 · WSO2 Open Banking AMfrom 2.0.0 before 2.0.0.398
• WSO2 · WSO2 Open Banking IAMfrom 2.0.0 before 2.0.0.418
• WSO2 · WSO2 Traffic Managerfrom 4.5.0 before 4.5.0.34; from 4.6.0 before 4.6.0.1
• WSO2 · WSO2 Universal Gatewayfrom 4.5.0 before 4.5.0.34; from 4.6.0 before 4.6.0.1
• WSO2 · WSO2 API Control Planefrom 4.5.0 before 4.5.0.36; from 4.6.0 before 4.6.0.1
• WSO2 · WSO2 API Managerfrom 3.1.0 before 3.1.0.349; from 3.2.0 before 3.2.0.453; from 3.2.1 before 3.2.1.73; from 4.0.0 before 4.0.0.373; from 4.1.0 before 4.1.0.236; from 4.2.0 before 4.2.0.176 and 4 more
• WSO2 · WSO2 Identity Server as Key Managerfrom 5.10.0 before 5.10.0.369
• WSO2 · WSO2 Identity Serverfrom 5.10.0 before 5.10.0.378; from 5.11.0 before 5.11.0.425; from 6.0.0 before 6.0.0.252; from 6.1.0 before 6.1.0.253; from 7.0.0 before 7.0.0.130; from 7.1.0 before 7.1.0.38 and 1 more

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

OS Command Injection · Command and Code Injection

Vendor

WSO2

Published

September 2026

Band

Unlikely (under 1%), September 2026

• NVD entrynvd.nist.gov
• CVE recordcve.org
• Weakness CWE-78cwe.mitre.org
• Vendor advisorysecurity.docs.wso2.com