Improper input validation enables remote code execution in multiple WSO2 Carbon Console products

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

The record sets the default status to unaffected for the products below, while identifying these branches as affected:

• WSO2 Open Banking AM: affected from 2.0.0 before 2.0.0.398. Versions before 2.0.0 are marked unknown.
• WSO2 Open Banking IAM: affected from 2.0.0 before 2.0.0.418. Versions before 2.0.0 are marked unknown.
• WSO2 Traffic Manager: affected from 4.5.0 before 4.5.0.34, and from 4.6.0 before 4.6.0.1.
• WSO2 Universal Gateway: affected from 4.5.0 before 4.5.0.34, and from 4.6.0 before 4.6.0.1.
• WSO2 API Control Plane: affected from 4.5.0 before 4.5.0.36, and from 4.6.0 before 4.6.0.1.
• WSO2 API Manager: affected from 3.1.0 before 3.1.0.349; from 3.2.0 before 3.2.0.453; from 3.2.1 before 3.2.1.73; from 4.0.0 before 4.0.0.373; from 4.1.0 before 4.1.0.236; from 4.2.0 before 4.2.0.176; from 4.3.0 before 4.3.0.88; from 4.4.0 before 4.4.0.52; from 4.5.0 before 4.5.0.35; and from 4.6.0 before 4.6.0.1. Versions before 3.1.0 are marked unknown.
• WSO2 Identity Server as Key Manager: affected from 5.10.0 before 5.10.0.369. Versions before 5.10.0 are marked unknown.
• WSO2 Identity Server: affected from 5.10.0 before 5.10.0.378; from 5.11.0 before 5.11.0.425; from 6.0.0 before 6.0.0.252; from 6.1.0 before 6.1.0.253; from 7.0.0 before 7.0.0.130; from 7.1.0 before 7.1.0.38; and from 7.2.0 before 7.2.0.1. Versions before 5.10.0 are marked unknown.

Administrative operations in the Carbon Console used by multiple WSO2 products do not adequately validate specific user-supplied input. The flaw is classified as CWE-78, meaning attacker-controlled input can reach an operation that leads to operating-system command or arbitrary code execution. Exploitation requires administrative privileges and Carbon Console access; the record describes adjacent-network reachability, low attack complexity, and no user interaction. Successful exploitation enables remote arbitrary code execution and can completely compromise the affected system. The advisory does not identify the specific administrative operations, validation boundary, or exploit input, so those implementation details remain unknown.

Exploitation requires high administrative privileges and access to the Carbon Console. The record characterizes the attack as reachable from an adjacent network, with low complexity and no user interaction. The flaw can be triggered through specific administrative operations and enables remote arbitrary code execution. The supplied record does not identify a public exploit or known exploitation status; that should not be interpreted as proof that exploitation has not occurred.

Successful exploitation allows arbitrary code execution through administrative operations in the Carbon Console. Technical consequences may include unauthorized data access, modification of data or configuration, and loss of service availability. Because administrative privileges are required, this is not an anonymous initial-access path; however, an attacker who obtains or abuses an administrator account could gain complete control of the affected system. The scope is marked as changed, indicating that impact may cross the security authority of the vulnerable component. The advisory does not establish the exact operating-system privileges or dependent systems that would be affected.

Successful exploitation can let an attacker run code with the privileges of the affected product process and completely compromise the affected system. Consequences may include unauthorized disclosure of data, modification of data or configuration, and service disruption. The record also marks the scope as changed, so impact may cross the original security authority of the vulnerable component. Actual organisational exposure depends on the privileges of the compromised administrator account, Carbon Console reachability, and deployment isolation controls.

1. Identify the product branch and current update level. Compare every deployment with the boundaries in affected_summary; do not treat a fix for one branch as evidence that every other branch is unaffected.
2. Apply the WSO2 update level for the relevant branch: API Control Plane 4.5.0.36 or 4.6.0.1; API Manager 3.1.0.349, 3.2.0.453, 3.2.1.73, 4.0.0.373, 4.1.0.236, 4.2.0.176, 4.3.0.88, 4.4.0.52, 4.5.0.35 or 4.6.0.1; Identity Server 5.10.0.378, 5.11.0.425, 6.0.0.252, 6.1.0.253, 7.0.0.130, 7.1.0.38 or 7.2.0.1; Identity Server as Key Manager 5.10.0.369; Open Banking AM 2.0.0.398; Open Banking IAM 2.0.0.418; Traffic Manager 4.5.0.34 or 4.6.0.1; Universal Gateway 4.5.0.34 or 4.6.0.1.
3. Community users should apply the relevant public fixes provided by WSO2. If applying the fix or update is not feasible, WSO2 recommends migrating to the corresponding unaffected version.
4. For systems that cannot be updated immediately, reduce Carbon Console reachability from adjacent networks, restrict administrative accounts, and increase monitoring of administrative operations. These are interim risk-reduction measures, not a replacement for the fix.
5. Verify after updating that the deployed release has crossed the affected boundary for the correct product branch, and check for parallel installations or related components.

1. Inventory WSO2 deployments that expose or include the Carbon Console and compare each product and release branch with the ranges in affected_summary.
2. Identify Carbon Console interfaces reachable from adjacent networks or unnecessary network segments, and review accounts with administrative privileges.
3. Review available authentication and administrative audit logs for unusual administrative sessions and use of relevant administrative operations during or after those sessions.
4. If the deployment collects process or command-execution telemetry, correlate anomalous activity with Carbon Console administrative sessions. This is precautionary monitoring, not a vendor-confirmed indicator.
5. No specific IOC is provided. The absence of suspicious log evidence does not prove that a deployment is safe.