Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-78674

Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 Enterprise Integrator (BPS profile)

Default version status: unknown

  • 0 to ≤ 6.6.0affected

WSO2 Business Process Server

Default version status: unaffected

  • 0 to ≤ 3.6.0affected

References