WSO2 Enterprise Integrator CVE-2025-9955

Exploitation requires an attacker to already possess valid low-privileged account credentials (PR:L) and adjacent-network reachability (AV:A) to the WSO2 EI/ESB management interface hosting the internal SOAP admin services tied to system-log and user-store-configuration operations. The flaw affects these specific admin services where permission restrictions are insufficient, so any WSO2 Enterprise Integrator 6.0.0-6.6.0 or Enterprise Service Bus 5.0.0 instance that provisions non-admin users and exposes its admin SOAP endpoints is at risk. Limiting factors: the attacker must be authenticated (not anonymous) and network-adjacent rather than fully remote, and the exposed data is operational/configuration detail only - no credentials or sensitive user data are disclosed, bounding the direct impact to reconnaissance value.

This is a lower-tier priority despite a CVSS base score of 5.7 (Medium). The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes an adjacent-network, low-complexity attack requiring low privileges (PR:L, so authenticated access) with no user interaction, and a confidentiality-only impact. The vector's C:H rating conflicts with the description, which explicitly states that 'no credentials or sensitive user information are exposed' and that the exposure is limited to internal operational details (logs, user-store configuration) - a C:H (high confidentiality loss) rating appears overstated for data the vendor itself characterizes as non-sensitive; C:L would be more defensible, so verify impact scope with the vendor advisory. Exploitation signals reinforce low urgency: EPSS is 0.21% (10th percentile), indicating very low predicted exploitation likelihood; the CVE is NOT on CISA KEV; and no public exploit code was identified in the provided intelligence. No SSVC decision data was supplied. Net assessment: a genuine but limited information-disclosure/authorization flaw useful mainly for reconnaissance that could aid chaining, not a standalone high-risk issue - it warrants patching in normal cycles rather than emergency response.

An attacker who already holds low-privileged credentials and has adjacent-network access to a WSO2 Enterprise Integrator management interface invokes the internal SOAP admin services and retrieves system logs and user-store configuration that should be restricted to administrators. The attacker uses this operational and topology information to plan follow-on attacks, such as identifying the backend user store or internal service details. No public exploit code was identified at the time of analysis.