WSO2 Enterprise Integrator CVE-2025-1862

Exploitation requires authenticated administrative access to the WSO2 management plane (CVSS PR:H) and that the vulnerable BPEL uploader SOAP service endpoint be present and reachable - this endpoint ships with the BPS/business-process capability of products such as Enterprise Integrator 6.6.0. The core limiting factor is the administrative-privilege prerequisite: an attacker cannot exploit this without already holding admin rights, which is why it is a privilege-to-RCE escalation rather than an unauthenticated compromise. Affected products per CPE are WSO2 Enterprise Integrator 6.6.0, Identity Server 5.10.0/5.11.0/6.0.0/6.1.0, Identity Server as Key Manager 5.10.0, and Open Banking IAM 2.0.0; systems not exposing the admin/BPEL SOAP interface to the attacker, or where admin access is strongly controlled and network-segmented, materially reduce realistic exploitability.

This is a genuinely dangerous bug (arbitrary file upload leading to RCE, CWE-434) but one whose real-world priority is materially constrained by its precondition. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:H, score 7.2) is internally consistent with the description: the BPEL uploader SOAP endpoint is network-reachable (AV:N) and low-complexity (AC:L), but PR:H confirms the attacker must already hold administrative privileges, which caps severity at High rather than Critical despite full C/I/A impact. The exploitation signals are weak-to-moderate: EPSS is only 0.25% (48th percentile), there is no CISA KEV listing, and no public exploit is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The low EPSS is coherent with the PR:H requirement, since mass automated exploitation is impractical when valid admin credentials are a prerequisite. No SSVC decision data was supplied. Net: this is a real post-authentication privilege-to-RCE escalation worth patching on WSO2 management-plane systems, but it is not a drop-everything internet-worm scenario; prioritize it where admin consoles are exposed or where admin credential compromise/insider threat is in scope. Note the single reference is the vendor advisory only - no independent fix-version confirmation was provided in the input.

An attacker who has obtained WSO2 administrative credentials (via phishing, credential reuse, or an insider) sends a crafted SOAP request to the BPEL uploader endpoint with a malicious filename that escapes the intended directory, planting a webshell or executable payload at a server-controlled path. Because filename validation is improper, the file lands where the attacker chooses and is subsequently executed, yielding remote code execution on the host. No public proof-of-concept is referenced in the provided data.