High · published September 3, 2026
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.
Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
| Product | Versions | Fixed in |
|---|---|---|
| wso2/api_control_plane | ≥ 4.5.0, < 4.5.0.36 | 4.5.0.36 |
| wso2/api_control_plane | all versions | — |
| wso2/api_manager | ≥ 3.1.0, < 3.1.0.349 | 3.1.0.349 |
| wso2/api_manager | ≥ 3.2.0, < 3.2.0.453 | 3.2.0.453 |
| wso2/api_manager | ≥ 3.2.1, < 3.2.1.73 | 3.2.1.73 |
| wso2/api_manager | ≥ 4.0.0, < 4.0.0.373 | 4.0.0.373 |
| wso2/api_manager | ≥ 4.1.0, < 4.1.0.236 | 4.1.0.236 |
| wso2/api_manager | ≥ 4.2.0, < 4.2.0.176 | 4.2.0.176 |
| wso2/api_manager | ≥ 4.3.0, < 4.3.0.88 | 4.3.0.88 |
| wso2/api_manager | ≥ 4.4.0, < 4.4.0.52 | 4.4.0.52 |
| wso2/api_manager | ≥ 4.5.0, < 4.5.0.35 | 4.5.0.35 |
| wso2/api_manager | all versions | — |
| wso2/identity_server | ≥ 5.10.0, < 5.10.0.378 | 5.10.0.378 |
| wso2/identity_server | ≥ 5.11.0, < 5.11.0.425 | 5.11.0.425 |
| wso2/identity_server | ≥ 6.0.0, < 6.0.0.252 | 6.0.0.252 |
| wso2/identity_server | ≥ 6.1.0, < 6.1.0.253 | 6.1.0.253 |
| wso2/identity_server | ≥ 7.0.0, < 7.0.0.130 | 7.0.0.130 |
| wso2/identity_server | ≥ 7.1.0, < 7.1.0.38 | 7.1.0.38 |
| wso2/identity_server | all versions | — |
| wso2/identity_server_as_key_manager | ≥ 5.10.0, < 5.10.0.369 | 5.10.0.369 |
| wso2/open_banking_am | ≥ 2.0.0, < 2.0.0.398 | 2.0.0.398 |
| wso2/open_banking_iam | ≥ 2.0.0, < 2.0.0.418 | 2.0.0.418 |
| wso2/traffic_manager | ≥ 4.5.0, < 4.5.0.34 | 4.5.0.34 |
| wso2/traffic_manager | all versions | — |
| wso2/universal_gateway | ≥ 4.5.0, < 4.5.0.34 | 4.5.0.34 |
| wso2/universal_gateway | all versions | — |