Enterprise Integrator Bps Profile
Monthly
Authenticated command injection in WSO2 Business Process Server and the BPS profile of WSO2 Enterprise Integrator allows any valid low-privileged account to execute arbitrary OS commands through insufficiently validated input parameters on the BPMN System REST APIs. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H, CWE-78), the flaw is network-reachable and needs no user interaction, but impact is bounded by the privileges of the product's runtime account - a least-privileged service account limits damage while a root/administrator runtime account yields full host compromise. No public exploit code, PoC reference, or CISA KEV entry appears in the available intelligence; the vendor (WSO2) published advisory WSO2-2026-5692 and prioritization is 'this_week'.
Authenticated command injection in WSO2 Business Process Server and the BPS profile of WSO2 Enterprise Integrator allows any valid low-privileged account to execute arbitrary OS commands through insufficiently validated input parameters on the BPMN System REST APIs. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H, CWE-78), the flaw is network-reachable and needs no user interaction, but impact is bounded by the privileges of the product's runtime account - a least-privileged service account limits damage while a root/administrator runtime account yields full host compromise. No public exploit code, PoC reference, or CISA KEV entry appears in the available intelligence; the vendor (WSO2) published advisory WSO2-2026-5692 and prioritization is 'this_week'.