High severity · published Nov 5, 2025
CVE-2025-11093
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment.
By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WSO2 API Control Plane · WSO2
4.5.0 before 4.5.0.29 · source: vendor
WA
WSO2 API Manager · WSO2
3.1.0 before 3.1.0.345; 3.2.0 before 3.2.0.446; 3.2.1 before 3.2.1.66; 4.0.0 before 4.0.0.366; 4.1.0 before 4.1.0.228; 4.2.0 before 4.2.0.169; +3 more · source: vendor
WE
WSO2 Enterprise Integrator · WSO2
6.6.0 before 6.6.0.224 · source: vendor
WI
WSO2 Identity Server as Key Manager · WSO2
5.10.0 before 5.10.0.365 · source: vendor
WM
WSO2 Micro Integrator · WSO2
4.0.0 before 4.0.0.145; 4.1.0 before 4.1.0.147; 4.2.0 before 4.2.0.141; 4.3.0 before 4.3.0.42; 4.4.0 before 4.4.0.27 · source: vendor
WO
WSO2 Open Banking AM · WSO2
2.0.0 before 2.0.0.394 · source: vendor
WO
WSO2 Open Banking IAM · WSO2
2.0.0 before 2.0.0.414 · source: vendor
WT
WSO2 Traffic Manager · WSO2
4.5.0 before 4.5.0.27 · source: vendor
WU
WSO2 Universal Gateway · WSO2
4.5.0 before 4.5.0.27 · source: vendor
OR
org.apache.synapse:synapse-core · WSO2
2.1.7.wso2v227 before 2.1.7.wso2v227_99; 2.1.7.wso2v271 before 2.1.7.wso2v271_88; 2.1.7.wso2v143 before 2.1.7.wso2v143_121; 2.1.7.wso2v319 before 2.1.7.wso2v319_13; 2.1.7.wso2v183 before 2.1.7.wso2v183_72; 4.0.0.wso2v119 before 4.0.0.wso2v119_27; +5 more · source: vendor
OR
org.apache.synapse:synapse-extensions · WSO2
2.1.7.wso2v227 before 2.1.7.wso2v227_99; 2.1.7.wso2v271 before 2.1.7.wso2v271_88; 2.1.7.wso2v143 before 2.1.7.wso2v143_121; 2.1.7.wso2v319 before 2.1.7.wso2v319_13; 2.1.7.wso2v183 before 2.1.7.wso2v183_72; 4.0.0.wso2v119 before 4.0.0.wso2v119_27; +5 more · source: vendor
AC
Api Control Plane · Wso2
4.5.0 before 4.5.0.29 · source: NVD