WSO2 Business Process Server CVE-2026-78674

Exploitation requires an authenticated account on the target (CVSS PR:L - any valid, low-privileged user suffices) and network reachability of the BPMN System REST APIs exposed by WSO2 Business Process Server or the Enterprise Integrator BPS profile. The attacker submits crafted requests whose input parameters are not sufficiently validated; the specific injectable parameter or endpoint is not described in the available advisory. No user interaction is needed. The principal limiting factors are the authentication requirement (not remotely exploitable by an anonymous user) and the fact that resulting impact is bounded by the OS permissions granted to the product's runtime account - a least-privileged service account constrains damage, while a root/administrator runtime account yields full host compromise.

This is a genuinely serious, prioritize-promptly issue rather than a high-CVSS-but-low-real-risk one, but the available signals are thin. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable REST API that any authenticated low-privileged user can exploit with low complexity and no user interaction, and CWE-78 command injection yielding C:H/I:H/A:H means full compromise of the runtime account - consistent with the 8.8 base score. The vuln.today decision label is 'this_week', indicating elevated but not emergency urgency. Critically, there is NO EPSS score, NO CISA KEV listing, and NO exploit/PoC reference in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The main gating factor keeping this below critical/emergency priority is PR:L - an attacker must already hold valid credentials - which argues against mass opportunistic exploitation and favors insider or post-authentication chaining scenarios. Net: real and worth patching this week, but current telemetry shows no in-the-wild activity and the authentication requirement meaningfully limits the attack population.

An attacker who holds a valid (even low-privileged) account on a WSO2 Business Process Server or Enterprise Integrator BPS-profile instance sends a crafted request to the BPMN System REST APIs, whose input parameters are insufficiently validated, injecting operating-system commands that run with the privileges of the product's runtime account. No public exploit code or PoC reference is provided in the available data, and the exact injectable parameter is not described in the source advisory.