{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12737", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2025-11-05T03:08:36.082Z", "datePublished": "2026-09-03T13:02:26.397Z", "dateUpdated": "2026-09-03T13:34:31.346Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-09-03T13:02:26.397Z"}, "title": "Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements Used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-82", "descriptions": [{"lang": "en", "value": "CAPEC-82 CAPEC-82: OS Commanding"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.398", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.418", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Traffic Manager", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.34", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.1", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Universal Gateway", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.34", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.1", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.36", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.1", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.349", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.453", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.73", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.373", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.236", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.176", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.88", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.52", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.35", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.1", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.369", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.378", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.425", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.252", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.253", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.130", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.38", "versionType": "custom"}, {"status": "affected", "version": "7.2.0", "lessThan": "7.2.0.1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.0.0.398"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.0.0.418"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5.0", "versionEndExcluding": "4.5.0.34"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6.0", "versionEndExcluding": "4.6.0.1"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5.0", "versionEndExcluding": "4.5.0.34"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6.0", "versionEndExcluding": "4.6.0.1"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5.0", "versionEndExcluding": "4.5.0.36"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6.0", "versionEndExcluding": "4.6.0.1"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1.0", "versionEndExcluding": "3.1.0.349"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.0", "versionEndExcluding": "3.2.0.453"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.1", "versionEndExcluding": "3.2.1.73"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.0.0.373"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.0", "versionEndExcluding": "4.1.0.236"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2.0", "versionEndExcluding": "4.2.0.176"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3.0", "versionEndExcluding": "4.3.0.88"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.0", "versionEndExcluding": "4.4.0.52"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5.0", "versionEndExcluding": "4.5.0.35"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6.0", "versionEndExcluding": "4.6.0.1"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.0", "versionEndExcluding": "5.10.0.369"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.0", "versionEndExcluding": "5.10.0.378"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.0", "versionEndExcluding": "5.11.0.425"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.0.252"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.1.0.253"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.0.130"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.0", "versionEndExcluding": "7.1.0.38"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2.0", "versionEndExcluding": "7.2.0.1"}]}]}], "descriptions": [{"lang": "en", "value": "The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.\n\nSuccessful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.\n\nSuccessful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/#solution</span></a> <br>"}]}], "source": {"advisory": "WSO2-2025-4771", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}, "x_gcve": [{"vulnId": "CVE-2025-12737", "recordType": "advisory"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-03T13:34:23.086494Z", "id": "CVE-2025-12737", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-03T13:34:31.346Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2025-12737", "date": "2026-10-24", "epss": "0.00223", "percentile": "0.1231"}, "nvd": "{\"cve\":{\"id\":\"CVE-2025-12737\",\"sourceIdentifier\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"published\":\"2026-09-03T14:17:00.183\",\"lastModified\":\"2026-10-19T22:10:00.130\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.\\n\\nSuccessful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.\"},{\"lang\":\"es\",\"value\":\"Las operaciones administrativas dentro de la Consola Carbon no validan adecuadamente ciertas entradas proporcionadas por el usuario. Esta omisi\u00f3n permite a un actor malicioso con privilegios administrativos inyectar y ejecutar c\u00f3digo arbitrario de forma remota.\\n\\nLa explotaci\u00f3n exitosa permite a un actor de amenaza con privilegios administrativos y acceso a la Consola Carbon ejecutar c\u00f3digo arbitrario remoto a trav\u00e9s de operaciones administrativas espec\u00edficas, lo que lleva a un compromiso completo del sistema afectado.\"}],\"affected\":[{\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"affectedData\":[{\"vendor\":\"WSO2\",\"product\":\"WSO2 Open Banking AM\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"2.0.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"2.0.0\",\"lessThan\":\"2.0.0.398\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Open Banking IAM\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"2.0.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"2.0.0\",\"lessThan\":\"2.0.0.418\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Traffic Manager\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.34\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Universal Gateway\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.34\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 API Control Plane\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.36\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 API Manager\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"3.1.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"3.1.0\",\"lessThan\":\"3.1.0.349\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.2.0\",\"lessThan\":\"3.2.0.453\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.2.1\",\"lessThan\":\"3.2.1.73\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.0.0\",\"lessThan\":\"4.0.0.373\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.1.0\",\"lessThan\":\"4.1.0.236\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.2.0\",\"lessThan\":\"4.2.0.176\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.3.0\",\"lessThan\":\"4.3.0.88\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.4.0\",\"lessThan\":\"4.4.0.52\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.35\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Identity Server as Key Manager\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.10.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"5.10.0\",\"lessThan\":\"5.10.0.369\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Identity Server\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.10.0\",\"versionType\":\"custom\",\"status\":\"unknown\"},{\"version\":\"5.10.0\",\"lessThan\":\"5.10.0.378\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.11.0\",\"lessThan\":\"5.11.0.425\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"6.0.0\",\"lessThan\":\"6.0.0.252\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"6.1.0\",\"lessThan\":\"6.1.0.253\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7.0.0\",\"lessThan\":\"7.0.0.130\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7.1.0\",\"lessThan\":\"7.1.0.38\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7.2.0\",\"lessThan\":\"7.2.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.7,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-03T13:34:23.086494Z\",\"id\":\"CVE-2025-12737\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5.0\",\"versionEndExcluding\":\"4.5.0.36\",\"matchCriteriaId\":\"99F3A07D-D3AA-42DB-BEC6-D9CE87A44E65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_control_plane:4.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F17BA3C7-B741-44CF-BA24-2FCBB39CCCF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.1.0\",\"versionEndExcluding\":\"3.1.0.349\",\"matchCriteriaId\":\"C8CF0FF2-E485-444F-9AFA-B83909FD59AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2.0\",\"versionEndExcluding\":\"3.2.0.453\",\"matchCriteriaId\":\"ED47318A-DA50-49E0-AA1E-9770EDEE6D54\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2.1\",\"versionEndExcluding\":\"3.2.1.73\",\"matchCriteriaId\":\"B57E7F97-6587-494F-8899-ECE0E7EAFBC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.0.0.373\",\"matchCriteriaId\":\"1CABD9FC-5B10-4D9B-8242-D9D83F80A8BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.1.0\",\"versionEndExcluding\":\"4.1.0.236\",\"matchCriteriaId\":\"9AC7069F-AE04-4AE3-A0B0-21C45E670E44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2.0\",\"versionEndExcluding\":\"4.2.0.176\",\"matchCriteriaId\":\"B3E1C611-500A-49DA-BBDC-06A7B3B604D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.3.0\",\"versionEndExcluding\":\"4.3.0.88\",\"matchCriteriaId\":\"1AF16206-C8E7-4248-8A64-029DCE69E022\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.0\",\"versionEndExcluding\":\"4.4.0.52\",\"matchCriteriaId\":\"7A2F0925-BE78-4294-832D-F4E2BF548C76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5.0\",\"versionEndExcluding\":\"4.5.0.35\",\"matchCriteriaId\":\"A4344D1F-D524-4145-8D66-37D373EC655F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E5EE2A0-2E46-46CA-96A9-F025D34390FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.0\",\"versionEndExcluding\":\"5.10.0.378\",\"matchCriteriaId\":\"0F45F03A-6B8D-41BC-99F7-D7FDB4461663\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11.0\",\"versionEndExcluding\":\"5.11.0.425\",\"matchCriteriaId\":\"0C3D7068-CC00-49C1-B5E2-D0AD8A574C56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.0.252\",\"matchCriteriaId\":\"E9C8F960-0F58-4399-BDDC-EA21850B6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.0\",\"versionEndExcluding\":\"6.1.0.253\",\"matchCriteriaId\":\"7A00EFFB-0CB0-4F53-A3B3-B3A31EFF6359\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.0.0.130\",\"matchCriteriaId\":\"5D06E76F-D338-474A-A04E-71D9440E48E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.1.0\",\"versionEndExcluding\":\"7.1.0.38\",\"matchCriteriaId\":\"1A73495D-37B9-498F-8FB5-4A0B6E121B76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:7.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2548396-1EA6-4934-AF37-BD1A69D5B63B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.0\",\"versionEndExcluding\":\"5.10.0.369\",\"matchCriteriaId\":\"A1C24E89-193C-4B91-8514-D24D777DB7EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.0.0.398\",\"matchCriteriaId\":\"726CD1C7-D156-4C7F-9A22-A3C443EB8951\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.0.0.418\",\"matchCriteriaId\":\"E8075CE4-B786-4DC2-98B6-34E498D6EB95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5.0\",\"versionEndExcluding\":\"4.5.0.34\",\"matchCriteriaId\":\"D8C38E3F-0C7C-4C19-A749-9AC03DD69E63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"933BA5C3-F145-498F-AF06-75CB9EE88046\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5.0\",\"versionEndExcluding\":\"4.5.0.34\",\"matchCriteriaId\":\"3A688746-24CD-4790-803F-9843886C609D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E189CD5B-E7D2-48B8-AFAD-9D9CDE6F8BBA\"}]}]}],\"references\":[{\"url\":\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/\",\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}", "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-12737\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-03T13:34:23.086494Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-03T13:34:28.139Z\"}}], \"cna\": {\"title\": \"Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution\", \"source\": {\"advisory\": \"WSO2-2025-4771\", \"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-82\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-82 CAPEC-82: OS Commanding\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.4, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"WSO2\", \"product\": \"WSO2 Open Banking AM\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"2.0.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.0.0.398\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Open Banking IAM\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"2.0.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.0.0.418\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Traffic Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.34\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.0\", \"lessThan\": \"4.6.0.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Universal Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.34\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.0\", \"lessThan\": \"4.6.0.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 API Control Plane\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.36\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.0\", \"lessThan\": \"4.6.0.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 API Manager\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"3.1.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.1.0\", \"lessThan\": \"3.1.0.349\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.2.0\", \"lessThan\": \"3.2.0.453\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.2.1\", \"lessThan\": \"3.2.1.73\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.0.373\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.1.0\", \"lessThan\": \"4.1.0.236\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.2.0\", \"lessThan\": \"4.2.0.176\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.0\", \"lessThan\": \"4.3.0.88\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.4.0\", \"lessThan\": \"4.4.0.52\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.35\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.0\", \"lessThan\": \"4.6.0.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Identity Server as Key Manager\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"5.10.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.10.0\", \"lessThan\": \"5.10.0.369\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Identity Server\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"5.10.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.10.0\", \"lessThan\": \"5.10.0.378\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.11.0\", \"lessThan\": \"5.11.0.425\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.0.0.252\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.1.0\", \"lessThan\": \"6.1.0.253\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.0.0\", \"lessThan\": \"7.0.0.130\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.1.0\", \"lessThan\": \"7.1.0.38\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.2.0\", \"lessThan\": \"7.2.0.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/#solution\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<span style=\\\"background-color: transparent;\\\">Follow the instructions given on </span><a target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/#solution\\\"><span style=\\\"background-color: transparent;\\\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/#solution</span></a> <br>\", \"base64\": false}]}], \"references\": [{\"url\": \"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.\\n\\nSuccessful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.\\n\\nSuccessful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78: Improper Neutralization of Special Elements Used in an OS Command ('OS Command Injection')\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.0.0.398\", \"versionStartIncluding\": \"2.0.0\"}], \"operator\": \"OR\"}, {\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.0.0.418\", \"versionStartIncluding\": \"2.0.0\"}], \"operator\": \"OR\"}, {\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.5.0.34\", \"versionStartIncluding\": \"4.5.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.6.0.1\", \"versionStartIncluding\": \"4.6.0\"}], \"operator\": \"OR\"}, {\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.5.0.34\", \"versionStartIncluding\": \"4.5.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.6.0.1\", \"versionStartIncluding\": \"4.6.0\"}], \"operator\": \"OR\"}, {\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.5.0.36\", \"versionStartIncluding\": \"4.5.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.6.0.1\", \"versionStartIncluding\": \"4.6.0\"}], \"operator\": \"OR\"}, {\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.1.0.349\", \"versionStartIncluding\": \"3.1.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.2.0.453\", \"versionStartIncluding\": \"3.2.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.2.1.73\", \"versionStartIncluding\": \"3.2.1\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.0.0.373\", \"versionStartIncluding\": \"4.0.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.1.0.236\", \"versionStartIncluding\": \"4.1.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.2.0.176\", \"versionStartIncluding\": \"4.2.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.3.0.88\", \"versionStartIncluding\": \"4.3.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.4.0.52\", \"versionStartIncluding\": \"4.4.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.5.0.35\", \"versionStartIncluding\": \"4.5.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.6.0.1\", \"versionStartIncluding\": \"4.6.0\"}], \"operator\": \"OR\"}, {\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.0.369\", \"versionStartIncluding\": \"5.10.0\"}], \"operator\": \"OR\"}, {\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.0.378\", \"versionStartIncluding\": \"5.10.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.11.0.425\", \"versionStartIncluding\": \"5.11.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.0.252\", \"versionStartIncluding\": \"6.0.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.0.253\", \"versionStartIncluding\": \"6.1.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0.0.130\", \"versionStartIncluding\": \"7.0.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1.0.38\", \"versionStartIncluding\": \"7.1.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.0.1\", \"versionStartIncluding\": \"7.2.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"ed10eef1-636d-4fbe-9993-6890dfa878f8\", \"shortName\": \"WSO2\", \"dateUpdated\": \"2026-09-03T13:02:26.397Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2025-12737\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-03T13:34:31.346Z\", \"dateReserved\": \"2025-11-05T03:08:36.082Z\", \"assignerOrgId\": \"ed10eef1-636d-4fbe-9993-6890dfa878f8\", \"datePublished\": \"2026-09-03T13:02:26.397Z\", \"assignerShortName\": \"WSO2\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}