CVE-2025-5717

Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service

State: Published
Severity: 6.8 Medium
Published: Sep 23, 2025
Updated: Oct 31, 2025
Reserved: Jun 5, 2025

Description

An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server.

Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	WSO2

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
WSO2 API ManagerWSO2	before 3.0.0Unknown 3.0.0 to before 3.0.0.174Affected 3.1.0 to before 3.1.0.330Affected 3.2.0 to before 3.2.0.426Affected 3.2.1 to before 3.2.1.46Affected 4.0.0 to before 4.0.0.344Affected 4.1.0 to before 4.1.0.208Affected 4.2.0 to before 4.2.0.147Affected 4.3.0 to before 4.3.0.59Affected 4.4.0 to before 4.4.0.22Affected 4.5.0 to before 4.5.0.6Affected
WSO2 Open Banking AMWSO2	before 2.0.0Unknown 2.0.0 to before 2.0.0.379Affected
WSO2 Traffic ManagerWSO2	4.5.0 to before 4.5.0.6Affected
WSO2 API Control PlaneWSO2	4.5.0 to before 4.5.0.6Affected
Siddhi Extension Evaluate ScriptsWSO2	3.2.6 to before 3.2.6.8Affected 3.2.7 to before 3.2.7.6Affected 3.2.8 to before 3.2.8.3Affected 3.2.10 to before 3.2.10.1Affected 3.2.13 to before 3.2.13.2Affected 3.2.14 to before 3.2.14.1Affected 3.2.15 and laterNot affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4119/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.