CVE-2025-12107: 
WSO2 Identity Server vulnerability analysis and mitigation

CVE-2025-12107 is a server-side template injection (SSTI) vulnerability in WSO2 Identity Server 5.11.0, caused by the use of a vulnerable third-party Apache Velocity template engine. A malicious actor with administrative privileges can inject and execute arbitrary template syntax within server-side templates, potentially leading to remote code execution (RCE). The vulnerability was published on February 19, 2026, and a patch is available via WSO2 security advisory WSO2-2025-4517. It carries a CVSS v3.1 base score of 7.2 (High) (WSO2 Advisory, Red Hat CVE).

The root cause is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), stemming from WSO2 Identity Server's reliance on a vulnerable version of the Apache Velocity template engine for server-side template rendering. An authenticated attacker with admin-level access can craft malicious Velocity template expressions and inject them into server-side templates, which are then evaluated and executed by the engine without adequate sanitization. The attack vector is network-based, requires no user interaction, and has low attack complexity — but does require high privileges (admin account). No public proof-of-concept exploit code has been identified at this time (WSO2 Advisory, Red Hat CVE).

Successful exploitation of CVE-2025-12107 can result in full system compromise, with HIGH impact to confidentiality, integrity, and availability. An attacker who gains or already holds admin credentials could execute arbitrary code on the server, manipulate or exfiltrate sensitive identity and authentication data managed by WSO2 Identity Server, and potentially pivot to other systems within the network. The scope is unchanged (limited to the vulnerable component), but the consequences within that scope are severe (WSO2 Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit for CVE-2025-12107 at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.363%, indicating a low probability of exploitation in the near term. Exploitation is constrained by the requirement for admin-level privileges, which significantly limits the attacker pool (Red Hat CVE, WSO2 Advisory).

1. Reconnaissance: Identify WSO2 Identity Server 5.11.0 instances exposed on the network, using service fingerprinting tools (e.g., Shodan, Censys) or internal asset inventories.
2. Obtain Admin Credentials: Acquire administrative credentials through phishing, credential stuffing, or insider access — exploitation requires a valid admin account.
3. Access Template Configuration: Log in to the WSO2 Identity Server admin console and navigate to a feature that allows editing or customizing server-side templates (e.g., email templates, notification templates, or UI customization areas powered by the Velocity engine).
4. Inject Malicious Velocity Payload: Insert a crafted Velocity template expression into an editable template field, such as #set($x='')#set($rt=$x.class.forName('java.lang.Runtime'))#set($chr=$x.class.forName('java.lang.Character'))#set($str=$x.class.forName('java.lang.String'))#set($ex=$rt.getRuntime().exec('id')) or similar RCE payloads.
5. Trigger Template Rendering: Save and trigger the template to be rendered by the server (e.g., by initiating a workflow or notification that uses the modified template).
6. Achieve Code Execution: The Velocity engine evaluates the injected expression server-side, executing arbitrary OS commands as the WSO2 service account, enabling data exfiltration, reverse shell establishment, or further lateral movement (WSO2 Advisory).

• Logs: WSO2 Identity Server logs (wso2carbon.log) showing Velocity template evaluation errors or unexpected template rendering activity; admin console access logs with unusual template modification events from unfamiliar IP addresses or at unusual times.
• Network: Outbound connections from the WSO2 server process to unknown external IPs, particularly on non-standard ports, following admin template modifications.
• Process: Unexpected child processes spawned by the WSO2 Java process (e.g., sh, bash, cmd.exe, curl, wget, python) indicating OS command execution via template injection.
• File System: New or modified files in the WSO2 deployment directory (e.g., web shells, scripts, or configuration changes) created by the WSO2 service account unexpectedly.

WSO2 has released a patch addressing CVE-2025-12107, detailed in security advisory WSO2-2025-4517. Organizations should apply the patch immediately by following the instructions provided in the advisory. As interim mitigations: restrict admin console access to trusted, known IP addresses using network-level controls; enforce the principle of least privilege for administrative accounts; monitor template processing and admin console activity for anomalous behavior; and consider network segmentation to limit exposure of the WSO2 Identity Server admin interface (WSO2 Advisory).

The vulnerability received coverage from security news outlets and community aggregators shortly after disclosure. The Hacker Wire published a technical article titled "Velocity Template Injection: Admin to RCE — CVE-2025-12107," highlighting the admin-to-RCE escalation path (The Hacker Wire). RedPacket Security and Mastodon security community accounts flagged the CVE for awareness. Overall community sentiment treats this as a moderate-severity issue due to the admin privilege prerequisite, though the RCE potential warrants prompt patching for organizations running WSO2 Identity Server.