The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/ Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.4 · wso2NVD modified 2026-10-19 22:10
Affected (CPE criteria) 13
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_control_plane:4.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:7.2.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*