CVE-2025-11093

published 2025-11-05

CVE-2025-11093: An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator…

Priority P3 51 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment.

By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.

Affected

60 ranges · showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	>= 4.5.0 < 4.5.0.29	4.5.0.29
wso2	api_manager	>= 3.1.0 < 3.1.0.345	3.1.0.345
wso2	api_manager	>= 3.2.0 < 3.2.0.446	3.2.0.446
wso2	api_manager	>= 3.2.1 < 3.2.1.66	3.2.1.66
wso2	api_manager	>= 4.1.0 < 4.1.0.228	4.1.0.228
wso2	api_manager	>= 4.2.0 < 4.2.0.169	4.2.0.169
wso2	api_manager	>= 4.3.0 < 4.3.0.81	4.3.0.81
wso2	api_manager	>= 4.4.0 < 4.4.0.45	4.4.0.45
wso2	api_manager	>= 4.5.0 < 4.5.0.28	4.5.0.28
wso2	enterprise_integrator	>= 6.6.0 < 6.6.0.224	6.6.0.224
wso2	micro_integrator	>= 4.0.0 < 4.0.0.145	4.0.0.145
wso2	micro_integrator	>= 4.1.0 < 4.1.0.147	4.1.0.147
wso2	micro_integrator	>= 4.2.0 < 4.2.0.141	4.2.0.141
wso2	micro_integrator	>= 4.3.0 < 4.3.0.42	4.3.0.42
wso2	micro_integrator	>= 4.4.0 < 4.4.0.27	4.4.0.27
wso2	org.apache.synapse_synapse-core	>= 2.1.7.wso2v143 < 2.1.7.wso2v143_121	2.1.7.wso2v143_121
wso2	org.apache.synapse_synapse-core	>= 2.1.7.wso2v183 < 2.1.7.wso2v183_72	2.1.7.wso2v183_72
wso2	org.apache.synapse_synapse-core	>= 2.1.7.wso2v227 < 2.1.7.wso2v227_99	2.1.7.wso2v227_99
wso2	org.apache.synapse_synapse-core	>= 2.1.7.wso2v271 < 2.1.7.wso2v271_88	2.1.7.wso2v271_88
wso2	org.apache.synapse_synapse-core	>= 2.1.7.wso2v319 < 2.1.7.wso2v319_13	2.1.7.wso2v319_13
wso2	org.apache.synapse_synapse-core	>= 4.0.0.wso2v105 < 4.0.0.wso2v105_13	4.0.0.wso2v105_13
wso2	org.apache.synapse_synapse-core	>= 4.0.0.wso2v119 < 4.0.0.wso2v119_27	4.0.0.wso2v119_27
wso2	org.apache.synapse_synapse-core	>= 4.0.0.wso2v131 < 4.0.0.wso2v131_5	4.0.0.wso2v131_5
wso2	org.apache.synapse_synapse-core	>= 4.0.0.wso2v20 < 4.0.0.wso2v20_93	4.0.0.wso2v20_93
wso2	org.apache.synapse_synapse-core	>= 4.0.0.wso2v215 < 4.0.0.wso2v215_26	4.0.0.wso2v215_26

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94