WSO2 Identity Server CVE-2025-12107

Exploitation requires a valid WSO2 Identity Server administrator account - confirmed by CVSS PR:H. The attacker must authenticate to the administrative interface and access a feature that passes admin-supplied input to the Velocity template engine without directive sanitization, such as email notification template configuration. No non-default configuration is required beyond possessing admin credentials. Exploitation is bounded by: (1) the hard requirement for administrator authentication, ruling out anonymous or low-privileged users entirely; (2) network reachability of the admin console, which is commonly restricted to internal or VPN-only networks in production deployments. Organizations that enforce MFA on admin accounts and restrict console access to management networks materially reduce real-world exploitability beyond what the raw CVSS score suggests.

The CVSS 7.2 score with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H accurately captures the central constraint: exploitation requires full administrator credentials. An adversary who already controls an admin account has substantial alternative impact paths, making this vulnerability most relevant to insider-threat or post-credential-compromise escalation scenarios rather than opportunistic external attack. The EPSS score of 0.44% (63rd percentile) reflects moderate relative interest against the broader CVE population but a low absolute probability of exploitation in the near term. The absence of a CISA KEV listing and the lack of confirmed public exploit code further reduce operational urgency. The C:H/I:H/A:H impact triad is realistic once template injection is achieved, as Velocity SSTI to RCE is a well-understood technique with published generic payloads. The 'Authentication Bypass' tag appearing in the source metadata is inconsistent with the PR:H requirement and should be disregarded as a mislabel.

An attacker who has compromised an administrator account - through phishing, credential stuffing against a reused password, or insider access - logs into the WSO2 Identity Server management console and navigates to a Velocity-rendered template configuration surface such as email notification templates. The attacker injects a Velocity SSTI payload using reflection-based class-loading (e.g., invoking Runtime.exec() via ClassTool or #set with ClassLoader calls) into a template field. When the server renders or previews the template, the payload executes arbitrary OS commands in the context of the Identity Server process, granting full system access.