CVE-2025-12737

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2025
Source publication: Sep 3, 2026
Source updated: Sep 3, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 Open Banking AM

Vendor: WSO2
Product: WSO2 Open Banking AM
Platforms: Unknown
Default status: unaffected

WSO2 Open Banking AM · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`unknown`	custom	2.0.0	Unavailable	None listed
2.0.0	`affected`	custom	2.0.0.398	Unavailable	None listed

WSO2 Open Banking IAM

Vendor: WSO2
Product: WSO2 Open Banking IAM
Platforms: Unknown
Default status: unaffected

WSO2 Open Banking IAM · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`unknown`	custom	2.0.0	Unavailable	None listed
2.0.0	`affected`	custom	2.0.0.418	Unavailable	None listed

WSO2 Traffic Manager

Vendor: WSO2
Product: WSO2 Traffic Manager
Platforms: Unknown
Default status: unaffected

WSO2 Traffic Manager · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
4.5.0	`affected`	custom	4.5.0.34	Unavailable	None listed
4.6.0	`affected`	custom	4.6.0.1	Unavailable	None listed

WSO2 Universal Gateway

Vendor: WSO2
Product: WSO2 Universal Gateway
Platforms: Unknown
Default status: unaffected

WSO2 Universal Gateway · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
4.5.0	`affected`	custom	4.5.0.34	Unavailable	None listed
4.6.0	`affected`	custom	4.6.0.1	Unavailable	None listed

WSO2 API Control Plane

Vendor: WSO2
Product: WSO2 API Control Plane
Platforms: Unknown
Default status: unaffected

WSO2 API Control Plane · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
4.5.0	`affected`	custom	4.5.0.36	Unavailable	None listed
4.6.0	`affected`	custom	4.6.0.1	Unavailable	None listed

WSO2 API Manager

Vendor: WSO2
Product: WSO2 API Manager
Platforms: Unknown
Default status: unaffected

WSO2 API Manager · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`unknown`	custom	3.1.0	Unavailable	None listed
3.1.0	`affected`	custom	3.1.0.349	Unavailable	None listed
3.2.0	`affected`	custom	3.2.0.453	Unavailable	None listed
3.2.1	`affected`	custom	3.2.1.73	Unavailable	None listed
4.0.0	`affected`	custom	4.0.0.373	Unavailable	None listed
4.1.0	`affected`	custom	4.1.0.236	Unavailable	None listed
4.2.0	`affected`	custom	4.2.0.176	Unavailable	None listed
4.3.0	`affected`	custom	4.3.0.88	Unavailable	None listed
4.4.0	`affected`	custom	4.4.0.52	Unavailable	None listed
4.5.0	`affected`	custom	4.5.0.35	Unavailable	None listed
4.6.0	`affected`	custom	4.6.0.1	Unavailable	None listed

WSO2 Identity Server as Key Manager

Vendor: WSO2
Product: WSO2 Identity Server as Key Manager
Platforms: Unknown
Default status: unaffected

WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`unknown`	custom	5.10.0	Unavailable	None listed
5.10.0	`affected`	custom	5.10.0.369	Unavailable	None listed

WSO2 Identity Server

Vendor: WSO2
Product: WSO2 Identity Server
Platforms: Unknown
Default status: unaffected

WSO2 Identity Server · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`unknown`	custom	5.10.0	Unavailable	None listed
5.10.0	`affected`	custom	5.10.0.378	Unavailable	None listed
5.11.0	`affected`	custom	5.11.0.425	Unavailable	None listed
6.0.0	`affected`	custom	6.0.0.252	Unavailable	None listed
6.1.0	`affected`	custom	6.1.0.253	Unavailable	None listed
7.0.0	`affected`	custom	7.0.0.130	Unavailable	None listed
7.1.0	`affected`	custom	7.1.0.38	Unavailable	None listed
7.2.0	`affected`	custom	7.2.0.1	Unavailable	None listed