CVE-2025-11093: 
WSO2 API Manager vulnerability analysis and mitigation

CVE-2025-11093 is an arbitrary code execution vulnerability affecting multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges (administrators or API creators) can execute arbitrary code within the integration runtime environment. The vulnerability was published on November 5, 2025, and assigned by WSO2 LLC. Affected products include WSO2 API Manager (versions 3.1.0 through 4.5.0), Micro Integrator (4.0.0 through 4.4.0), Enterprise Integrator (6.6.0), API Control Plane (4.5.0), Traffic Manager (4.5.0), and Universal Gateway (4.5.0). The CVSS v3.1 base score is 7.2 (High) per NVD, and 8.4 (High) per WSO2 as the CNA (WSO2 Advisory).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), stemming from insufficient sandboxing or access restrictions applied to the GraalJS and NashornJS scripting engines used in WSO2's Script Mediator component. An attacker with administrative privileges (or API creator privileges in WSO2 API Manager) can craft and submit malicious scripts through the Script Mediator interface, which are then executed without adequate restrictions within the integration runtime. The attack vector is network-based, requires high privileges, and no user interaction, making it exploitable remotely by any sufficiently privileged authenticated user (WSO2 Advisory).

Successful exploitation allows a privileged authenticated attacker to execute arbitrary code within the WSO2 integration runtime environment, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker could access sensitive data processed by the integration platform, manipulate integration flows, or disrupt service availability. In WSO2 API Manager, the broader access granted to API creators (in addition to administrators) expands the potential attacker pool, increasing the risk of insider threat or compromised account scenarios (WSO2 Advisory).

As of the available intelligence, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2025-11093. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (WSO2 Advisory).

1. Reconnaissance: Identify internet-facing WSO2 API Manager, Micro Integrator, or Enterprise Integrator instances running vulnerable versions using network scanning tools or Shodan queries targeting WSO2 management ports.
2. Credential Acquisition: Obtain valid administrator or API creator credentials through phishing, credential stuffing, or insider access — exploitation requires authenticated, privileged access.
3. Access Script Mediator: Log in to the WSO2 management console or API Publisher and navigate to the integration artifact configuration where the Script Mediator (GraalJS or NashornJS engine) is accessible.
4. Inject Malicious Script: Craft a malicious JavaScript payload targeting the GraalJS or NashornJS engine (e.g., using Java interop features available in these engines to invoke system-level commands) and embed it within a Script Mediator configuration.
5. Trigger Execution: Deploy or invoke the integration sequence containing the malicious script, causing the WSO2 runtime to execute the injected code with the privileges of the integration service account.
6. Achieve Objective: Leverage code execution to exfiltrate data, establish persistence, pivot to other internal systems, or disrupt integration services (WSO2 Advisory).

• Logs: Unusual or unexpected JavaScript code appearing in WSO2 integration sequence configurations or audit logs; error messages from GraalJS or NashornJS engines referencing Java class access or system calls in wso2carbon.log or synapse.log.
• Process: Unexpected child processes spawned by the WSO2 Carbon JVM process (e.g., sh, bash, cmd.exe, curl, wget, python) indicating OS command execution from within the scripting engine.
• Network: Outbound connections from the WSO2 server to unknown external IP addresses or domains, particularly on non-standard ports, following administrative login events.
• File System: New or modified files in the WSO2 deployment directory (e.g., <WSO2_HOME>/repository/deployment/server/) that were not part of a legitimate deployment; unexpected cron jobs or scheduled tasks created under the WSO2 service account.
• Authentication Logs: Multiple logins from the same privileged account (admin or API creator) from unusual source IPs or at unusual times, preceding suspicious Script Mediator activity.

WSO2 has released patched versions for all affected products. Organizations should upgrade to the following minimum versions: API Manager 3.1.0.345, 3.2.0.446, 3.2.1.66, 4.0.0.366, 4.1.0.228, 4.2.0.169, 4.3.0.81, 4.4.0.45, or 4.5.0.28; Micro Integrator 4.0.0.145, 4.1.0.147, 4.2.0.141, 4.3.0.42, or 4.4.0.27; Enterprise Integrator 6.6.0.224; API Control Plane 4.5.0.29; Traffic Manager 4.5.0.27; Universal Gateway 4.5.0.27. As interim mitigations, organizations should restrict administrative and API creator access to trusted personnel only, implement strict network-level access controls to WSO2 management interfaces, and audit privileged user activities for anomalous script deployments (WSO2 Advisory).