What is the CVSS score of CVE-2025-12737?

CVE-2025-12737 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WSO2 Carbon Console are affected by CVE-2025-12737?

WSO2's shared administrative console (spanning API Manager, Identity Server, Open Banking, Traffic Manager, and four other middleware products) contains an OS command injection vulnerability…. A patch is available.

How to fix or mitigate CVE-2025-12737?

Within 24 hours, inventory all WSO2 product instances in your environment, identify all administrative console users, and immediately restrict console access to hardened bastion hosts requiring multi-factor authentication; segment administrative networks from production systems. Within 7 days, enable comprehensive audit logging on the Carbon Console with real-time alerting on login and command execution events, revoke or disable unnecessary administrative accounts, and establish network access control lists limiting console reach to authorized networks only. Within 30 days, establish daily monitoring of WSO2 security advisories for patch releases, define a 48-hour deployment window once a vendor patch is available, and conduct incident response drills testing detection and response to console compromise.

WSO2 Carbon Console CVE-2025-12737

EUVD-2025-210842 HIGH

OS Command Injection (CWE-78)

2026-09-03 WSO2

GHSA-h2f7-75mh-c4rv

RCE Command Injection Wso2 Open Banking Am Wso2 Open Banking Iam Wso2 Traffic Manager Wso2 Universal Gateway Wso2 Api Control Plane Wso2 Api Manager Wso2 Identity Server As Key Manager Wso2 Identity Server

8.4

CVSS 3.1 · Vendor: WSO2

Severity by source

Vendor (WSO2) PRIMARY

8.4 HIGH

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

Vendor-supplied vector is accurate: admin credentials required (PR:H), management network adjacency needed (AV:A), full host compromise with scope change (S:C/C:H/I:H/A:H).

3.1 AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (WSO2).

CVSS VectorVendor: WSO2

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 03, 2026 - 15:01 EUVD

Analysis Generated

Sep 03, 2026 - 13:51 vuln.today

CVE Published

Sep 03, 2026 - 13:02 cve.org

HIGH 8.4

DescriptionCVE.org

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.

Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

AnalysisAI

OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems.

Technical ContextAI

Carbon Console is WSO2's shared web-based administrative UI, built on the open-source WSO2 Carbon framework and bundled into virtually every WSO2 middleware product. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) identifies the root cause: one or more administrative operations pass user-supplied input to OS-level command execution without adequate sanitization or escaping. The adjacent attack vector (AV:A) aligns with Carbon Console's typical deployment on a management or internal network segment, not the public internet. Affected products span the full WSO2 ecosystem per CPE: wso2_api_manager, wso2_identity_server, wso2_identity_server_as_key_manager, wso2_open_banking_am, wso2_open_banking_iam, wso2_traffic_manager, wso2_universal_gateway, and wso2_api_control_plane. Exact vulnerable version ranges are not specified in the CPE data (wildcard versions).

RemediationAI

Consult the WSO2 security advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/ for confirmed fixed versions across each affected product - exact patch version numbers are not independently confirmed from the available CPE data, which uses wildcard version ranges. As an immediate compensating control, restrict network access to Carbon Console management ports to trusted administrator IP ranges only, leveraging firewall or network ACL rules; this directly exploits the AV:A vector limitation and prevents unapproved adjacent-network actors from reaching the interface even with stolen credentials. Enforce multi-factor authentication on all Carbon Console administrative accounts to raise the bar for credential compromise. Audit administrative account usage for anomalous activity. Until patched, consider disabling specific administrative operations identified in the advisory as the injection vectors if WSO2 documents them.