CVE-2025-12737

CVE-2025-12737 is a command injection flaw (CWE-78) in the Carbon Console of multiple WSO2 products, where specific administrative operations fail to adequately validate user-supplied input. An attacker who already holds administrative privileges and has access to the Carbon Console can submit crafted input through these operations to inject and execute arbitrary code remotely. Successful exploitation yields full remote code execution and complete compromise of the host running the affected WSO2 product, so an attacker can move from an already-compromised or stolen admin session to owning the server. The flaw affects WSO2 API Manager, API Control Plane, Identity Server, Identity Server as Key Manager, Open Banking AM, Open Banking IAM, Traffic Manager, and Universal Gateway. As of now there is no known public proof-of-concept, it is not in CISA's KEV catalog, and EPSS puts short-term exploitation odds at roughly 0.2%.

What to do: Check the official WSO2 security advisory for CVE-2025-12737 and upgrade each affected product to the patched release it lists, since exact fixed versions are not provided in the available data. In the meantime, restrict Carbon Console (admin, typically port 9443) access to trusted admin networks via firewall/VPN rules, review and rotate administrative credentials for signs of compromise, and monitor the console logs for unusual administrative operations.