CVE-2025-12737

highpriority · track · 0EPSS 0.004 · 31 %ileUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.37% (31st) EPSS

CVSS 8.4 · high

Is it mine?

26 products

Check your exposure

Who says so?

1 sources

nvd

EPSS · scored 2026-10-27

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

cvss

Technical severity, 0–10. One row per scoring source.

8.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.4highCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondaryexploitability 1.7 · impact 6

v3.17.7highCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-78US

affected products (26)

Products and version ranges known to be affected.

wso2 api control plane4.5.0 → 4.5.0.36nvdUScpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*
wso2 api control plane= 4.6.0nvdUScpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*
wso2 api manager3.1.0 → 3.1.0.349nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager3.2.0 → 3.2.0.453nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager3.2.1 → 3.2.1.73nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager4.0.0 → 4.0.0.373nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager4.1.0 → 4.1.0.236nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager4.2.0 → 4.2.0.176nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager4.3.0 → 4.3.0.88nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager4.4.0 → 4.4.0.52nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager4.5.0 → 4.5.0.35nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager= 4.6.0nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 identity server5.10.0 → 5.10.0.378nvdUScpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
wso2 identity server5.11.0 → 5.11.0.425nvdUScpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
wso2 identity server6.0.0 → 6.0.0.252nvdUScpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
wso2 identity server6.1.0 → 6.1.0.253nvdUScpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
wso2 identity server7.0.0 → 7.0.0.130nvdUScpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
wso2 identity server7.1.0 → 7.1.0.38nvdUScpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
wso2 identity server= 7.2.0nvdUScpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
wso2 identity server as key manager5.10.0 → 5.10.0.369nvdUScpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*

showing 20 of 26

sources

Which sources assert this record, and when.

nvd NVD CVE.org MITRE

published 2026-09-03modified 2026-10-19

references (1) nvd

External citations — patches, advisories, analysis.

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/PatchVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan