CVE-2025-5717: wso2 api_control_plane Code Injection
Vulnerability summary
CVE-2025-5717 is a high (CVSS 7.2) Code Injection vulnerability in wso2 api_control_plane. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 51.9% of scored vulnerabilities.
Timeline
- 23-09-2025PublishedVulnerability first disclosed.
- 31-10-2025Last modifiedVulnerability information updated.
Description
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server. Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA6.8MediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wso29 products
- api_control_plane4.5.0
- api_manager3.0.0 | 3.1.0 | 3.2.0 | 3.2.1 | 4.0.0 | 4.1.0 | 4.2.0 | 4.3.0 | 4.4.0 | 4.5.0
- open_banking_am2.0.0
- siddhi extension evaluate scripts≥ 3.2.6, < 3.2.6.8 | ≥ 3.2.7, < 3.2.7.6 | ≥ 3.2.8, < 3.2.8.3 | ≥ 3.2.10, < 3.2.10.1 | ≥ 3.2.13, < 3.2.13.2 | ≥ 3.2.14, < 3.2.14.1
- traffic_manager4.5.0
1 vendor · 9 products