{"id":"CVE-2025-12737","title":"The administrative operations within the Carbon Console do not adequately validate specific user-supplied input","summary":"The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.\n\nSucce…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"wso2","product":"api_control_plane","affected":["api_control_plane >= 4.5.0, < 4.5.0.36","api_control_plane = 4.6.0","api_manager >= 3.1.0, < 3.1.0.349","api_manager >= 3.2.0, < 3.2.0.453","api_manager >= 3.2.1, < 3.2.1.73","api_manager >= 4.0.0, < 4.0.0.373","api_manager >= 4.1.0, < 4.1.0.236","api_manager >= 4.2.0, < 4.2.0.176","api_manager >= 4.3.0, < 4.3.0.88","api_manager >= 4.4.0, < 4.4.0.52","api_manager >= 4.5.0, < 4.5.0.35","api_manager = 4.6.0","identity_server >= 5.10.0, < 5.10.0.378","identity_server >= 5.11.0, < 5.11.0.425","identity_server >= 6.0.0, < 6.0.0.252","identity_server >= 6.1.0, < 6.1.0.253","identity_server >= 7.0.0, < 7.0.0.130","identity_server >= 7.1.0, < 7.1.0.38","identity_server = 7.2.0","identity_server_as_key_manager >= 5.10.0, < 5.10.0.369","open_banking_am >= 2.0.0, < 2.0.0.398","open_banking_iam >= 2.0.0, < 2.0.0.418","traffic_manager >= 4.5.0, < 4.5.0.34","traffic_manager = 4.6.0","universal_gateway >= 4.5.0, < 4.5.0.34","universal_gateway = 4.6.0"],"patched":["api_control_plane 4.5.0.36","api_manager 4.5.0.35","identity_server 7.1.0.38","identity_server_as_key_manager 5.10.0.369","open_banking_am 2.0.0.398","open_banking_iam 2.0.0.418","traffic_manager 4.5.0.34","universal_gateway 4.5.0.34"],"published":"2026-09-03","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:00:20.833","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-12737","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/","label":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"tags":["nvd"],"epss":0.00223,"epssPercentile":0.13223,"ingestedAt":"2026-09-09T20:21:14.799Z","slug":"CVE-2025-12737","body":"## Overview\n\nThe administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.\n\nSuccessful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.\n\n## Affected\n\n- `api_control_plane >= 4.5.0, < 4.5.0.36`\n- `api_control_plane = 4.6.0`\n- `api_manager >= 3.1.0, < 3.1.0.349`\n- `api_manager >= 3.2.0, < 3.2.0.453`\n- `api_manager >= 3.2.1, < 3.2.1.73`\n- `api_manager >= 4.0.0, < 4.0.0.373`\n- `api_manager >= 4.1.0, < 4.1.0.236`\n- `api_manager >= 4.2.0, < 4.2.0.176`\n- `api_manager >= 4.3.0, < 4.3.0.88`\n- `api_manager >= 4.4.0, < 4.4.0.52`\n- `api_manager >= 4.5.0, < 4.5.0.35`\n- `api_manager = 4.6.0`\n- `identity_server >= 5.10.0, < 5.10.0.378`\n- `identity_server >= 5.11.0, < 5.11.0.425`\n- `identity_server >= 6.0.0, < 6.0.0.252`\n- `identity_server >= 6.1.0, < 6.1.0.253`\n- `identity_server >= 7.0.0, < 7.0.0.130`\n- `identity_server >= 7.1.0, < 7.1.0.38`\n- `identity_server = 7.2.0`\n- `identity_server_as_key_manager >= 5.10.0, < 5.10.0.369`\n- `open_banking_am >= 2.0.0, < 2.0.0.398`\n- `open_banking_iam >= 2.0.0, < 2.0.0.418`\n- `traffic_manager >= 4.5.0, < 4.5.0.34`\n- `traffic_manager = 4.6.0`\n- `universal_gateway >= 4.5.0, < 4.5.0.34`\n- `universal_gateway = 4.6.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `api_control_plane 4.5.0.36`\n- `api_manager 4.5.0.35`\n- `identity_server 7.1.0.38`\n- `identity_server_as_key_manager 5.10.0.369`\n- `open_banking_am 2.0.0.398`\n- `open_banking_iam 2.0.0.418`\n- `traffic_manager 4.5.0.34`\n- `universal_gateway 4.5.0.34`","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}