Description
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
Affected products
wso2: api control plane; wso2: api manager; wso2: identity server; wso2: identity server as key manager; wso2: open banking am; wso2: open banking iam; wso2: traffic manager; wso2: universal gateway
References1
- security.docs.wso2.com/en/latest/security-announcements/securit… PatchVendor Advisory
Metrics
- CVSS 3.1
-
8.4
HIGH
Score source: CNA
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 31 · as of 3 November 2026
- CWE
- CWE-78
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.