CVE-2025-12737: The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with…

PriorityP349high8.4CVSS 3.1

AVAACLPRHUINSCCHIHAH

EPSS

0.22%

12.0th percentile

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

Affected

52 ranges· showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	—	—
wso2	api_control_plane	>= 4.5.0 < 4.5.0.36	4.5.0.36
wso2	api_manager	—	—
wso2	api_manager	>= 3.1.0 < 3.1.0.349	3.1.0.349
wso2	api_manager	>= 3.2.0 < 3.2.0.453	3.2.0.453
wso2	api_manager	>= 3.2.1 < 3.2.1.73	3.2.1.73
wso2	api_manager	>= 4.0.0 < 4.0.0.373	4.0.0.373
wso2	api_manager	>= 4.1.0 < 4.1.0.236	4.1.0.236
wso2	api_manager	>= 4.2.0 < 4.2.0.176	4.2.0.176
wso2	api_manager	>= 4.3.0 < 4.3.0.88	4.3.0.88
wso2	api_manager	>= 4.4.0 < 4.4.0.52	4.4.0.52
wso2	api_manager	>= 4.5.0 < 4.5.0.35	4.5.0.35
wso2	identity_server	—	—
wso2	identity_server	>= 5.10.0 < 5.10.0.378	5.10.0.378
wso2	identity_server	>= 5.11.0 < 5.11.0.425	5.11.0.425
wso2	identity_server	>= 6.0.0 < 6.0.0.252	6.0.0.252
wso2	identity_server	>= 6.1.0 < 6.1.0.253	6.1.0.253
wso2	identity_server	>= 7.0.0 < 7.0.0.130	7.0.0.130
wso2	identity_server	>= 7.1.0 < 7.1.0.38	7.1.0.38
wso2	identity_server_as_key_manager	>= 5.10.0 < 5.10.0.369	5.10.0.369
wso2	open_banking_am	>= 2.0.0 < 2.0.0.398	2.0.0.398
wso2	open_banking_iam	>= 2.0.0 < 2.0.0.418	2.0.0.418
wso2	traffic_manager	—	—
wso2	traffic_manager	>= 4.5.0 < 4.5.0.34	4.5.0.34
wso2	universal_gateway	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.