What is the CVSS score of CVE-2025-12107?

CVE-2025-12107 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WSO2 Identity Server are affected by CVE-2025-12107?

WSO2 Identity Server 5.11.0 contains a server-side template injection vulnerability allowing authenticated administrators to execute arbitrary code on the authentication infrastructure.

How to fix or mitigate CVE-2025-12107?

Within 24 hours, contact WSO2 support to confirm patch status and obtain an ETA, audit all privileged administrative accounts, and enable enhanced logging of management console access. Within 7 days, implement network segmentation restricting admin console access to authorized networks only, require multi-factor authentication for all administrative accounts, and review recent admin activities for signs of exploitation. Within 30 days, deploy the vendor patch upon release or plan an upgrade to a supported patched version; if patch availability extends beyond 30 days, escalate to executive risk review for consideration of alternative identity providers.

WSO2 Identity Server CVE-2025-12107

HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-02-19 ed10eef1-636d-4fbe-9993-6890dfa878f8

RCE Ssti Identity Server Wso2

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin console is network-accessible with no interaction required, but full admin authentication is mandatory; successful SSTI enables full confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 03, 2026 - 14:40 vuln.today

tag: Authentication Bypass removed

Analysis Updated

Sep 03, 2026 - 14:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 03, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Sep 03, 2026 - 14:22 NVD

8.4 (HIGH) 7.2 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 10:16 nvd

HIGH 8.4

DescriptionNVD

Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates.

Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.

AnalysisAI

Server-side template injection via Apache Velocity in WSO2 Identity Server 5.11.0 enables an authenticated administrator to execute arbitrary code on the underlying server. The vulnerability stems from insufficient sandboxing of user-controlled input passed to the Velocity rendering engine in admin-accessible surfaces, allowing template directives to invoke JVM reflection and reach OS-level execution. No public exploit code has been identified at time of analysis; EPSS of 0.44% at the 63rd percentile indicates moderate relative interest but low absolute near-term exploitation probability.

Technical ContextAI

WSO2 Identity Server is an enterprise open-source identity and access management platform widely deployed for SSO, federation, and API security. The affected version (5.11.0, CPE: cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*) uses Apache Velocity as a server-side template engine, typically for rendering email notification templates and certain administrative views. CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) identifies the root cause: the application fails to sanitize or sandbox Velocity directives submitted by administrators, permitting constructs such as #set, #evaluate, or class-loading chains that escape the intended rendering context and execute arbitrary JVM code. Apache Velocity's permissive default execution model - which allows reflection-based class instantiation - is a well-documented SSTI escalation path to OS command execution.

RemediationAI

Consult vendor advisory WSO2-2025-4517 at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517/ for the exact patched release version and upgrade instructions - no specific fix version number is independently confirmed in the available data. As a compensating control, restrict admin console access to trusted internal networks or VPN-only segments via firewall rules, reducing the network attack surface despite the existing PR:H requirement. Enforce multi-factor authentication on all administrator accounts to reduce risk from credential-compromise scenarios, which represent the primary realistic attack path. Audit administrator account assignments and apply least-privilege principles to limit the number of accounts that could reach the vulnerable template configuration surfaces. Monitoring admin console activity for unusual template modifications provides detection coverage while a patch is pending.