Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

Summary

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

Timeline

1. Sep 3, 2026, 1:02 PM UTCCVE published
2. Sep 3, 2026, 1:34 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Sep 3, 2026, 1:34 PM UTCRecord last updated

Affected versions

• WSO2 WSO2 Open Banking AM

  From 2.0.0 · fixed in 2.0.0.398

• WSO2 WSO2 Open Banking IAM

  From 2.0.0 · fixed in 2.0.0.418

• WSO2 WSO2 Traffic Manager

  From 4.5.0 · fixed in 4.5.0.34; From 4.6.0 · fixed in 4.6.0.1

• WSO2 WSO2 Universal Gateway

  From 4.5.0 · fixed in 4.5.0.34; From 4.6.0 · fixed in 4.6.0.1

• WSO2 WSO2 API Control Plane

  From 4.5.0 · fixed in 4.5.0.36; From 4.6.0 · fixed in 4.6.0.1

• WSO2 WSO2 API Manager

  From 3.1.0 · fixed in 3.1.0.349; From 3.2.0 · fixed in 3.2.0.453; From 3.2.1 · fixed in 3.2.1.73; From 4.0.0 · fixed in 4.0.0.373; From 4.1.0 · fixed in 4.1.0.236; From 4.2.0 · fixed in 4.2.0.176; From 4.3.0 · fixed in 4.3.0.88; From 4.4.0 · fixed in 4.4.0.52; From 4.5.0 · fixed in 4.5.0.35; From 4.6.0 · fixed in 4.6.0.1

• WSO2 WSO2 Identity Server as Key Manager

  From 5.10.0 · fixed in 5.10.0.369

• WSO2 WSO2 Identity Server

  From 5.10.0 · fixed in 5.10.0.378; From 5.11.0 · fixed in 5.11.0.425; From 6.0.0 · fixed in 6.0.0.252; From 6.1.0 · fixed in 6.1.0.253; From 7.0.0 · fixed in 7.0.0.130; From 7.1.0 · fixed in 7.1.0.38; From 7.2.0 · fixed in 7.2.0.1

References 1