CVE-2025-12737: WSO2 API Control Plane

High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

Affected products

• WSO2 API Control Plane: from 4.5.0, before 4.5.0.36 (fixed in 4.5.0.36); version 4.6.0 only
• WSO2 API Manager: from 3.1.0, before 3.1.0.349 (fixed in 3.1.0.349); from 3.2.0, before 3.2.0.453 (fixed in 3.2.0.453); from 3.2.1, before 3.2.1.73 (fixed in 3.2.1.73); from 4.0.0, before 4.0.0.373 (fixed in 4.0.0.373); from 4.1.0, before 4.1.0.236 (fixed in 4.1.0.236); from 4.2.0, before 4.2.0.176 (fixed in 4.2.0.176); …
• WSO2 Identity Server: from 5.10.0, before 5.10.0.378 (fixed in 5.10.0.378); from 5.11.0, before 5.11.0.425 (fixed in 5.11.0.425); from 6.0.0, before 6.0.0.252 (fixed in 6.0.0.252); from 6.1.0, before 6.1.0.253 (fixed in 6.1.0.253); from 7.0.0, before 7.0.0.130 (fixed in 7.0.0.130); from 7.1.0, before 7.1.0.38 (fixed in 7.1.0.38); …
• WSO2 Identity Server As Key Manager: from 5.10.0, before 5.10.0.369 (fixed in 5.10.0.369)
• WSO2 Open Banking AM: from 2.0.0, before 2.0.0.398 (fixed in 2.0.0.398)
• WSO2 Open Banking Iam: from 2.0.0, before 2.0.0.418 (fixed in 2.0.0.418)
• WSO2 Traffic Manager: from 4.5.0, before 4.5.0.34 (fixed in 4.5.0.34); version 4.6.0 only
• WSO2 Universal Gateway: from 4.5.0, before 4.5.0.34 (fixed in 4.5.0.34); version 4.6.0 only

Published 2026-09-03. Last modified 2026-09-09.