CVE-2025-12737
highThe administrative operations within the Carbon Console do not adequately validate specific user-supplied input.
Vendor / product: Wso2 — api control plane
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
CVSS
8.4
8.4 (CVSS v3.1)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (ed10eef1-636d-4fbe-9993-6890dfa878f8)
Timeline (UTC)
Published: 2026-09-03 14:17
Modified: 2026-10-19 22:10
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 06:50 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
wso2 / api_control_plane ≥4.5.0 <4.5.0.36, 4.6.0
wso2 / api_manager ≥3.1.0 <3.1.0.349, ≥3.2.0 <3.2.0.453, ≥3.2.1 <3.2.1.73, ≥4.0.0 <4.0.0.373, ≥4.1.0 <4.1.0.236, ≥4.2.0 <4.2.0.176
wso2 / identity_server ≥5.10.0 <5.10.0.378, ≥5.11.0 <5.11.0.425, ≥6.0.0 <6.0.0.252, ≥6.1.0 <6.1.0.253, ≥7.0.0 <7.0.0.130, ≥7.1.0 <7.1.0.38
wso2 / identity_server_as_key_manager ≥5.10.0 <5.10.0.369
wso2 / open_banking_am ≥2.0.0 <2.0.0.398
wso2 / open_banking_iam ≥2.0.0 <2.0.0.418
wso2 / traffic_manager ≥4.5.0 <4.5.0.34, 4.6.0
wso2 / universal_gateway ≥4.5.0 <4.5.0.34, 4.6.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/W... ed10eef1-636d-4fbe-9993-6890dfa878f8
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:50 UTC · record ↗