WSO2 products: Remote code execution via JDBC user store configuration

Summary

Several WSO2 products built on the Carbon kernel, including Identity Server, API Manager and Enterprise Integrator, do not properly validate input in the configuration of JDBC user stores. An attacker who can supply crafted input through the Management Console can execute arbitrary code on the server with the privileges of the WSO2 product, which can lead to full system compromise. The CVE data gives a CVSS score of 9.1 (critical) without authentication, but the vendor advisory could not be opened for verification, so its own rating and the required privileges should be checked.

Affected

• Enterprise Integrator 6.6.0 before 6.6.0.204
• API Manager 3.1.0 before 3.1.0.275, 3.2.0 before 3.2.0.365, 3.2.1 before 3.2.1.19, 4.0.0 before 4.0.0.308, 4.1.0 before 4.1.0.170, 4.2.0 before 4.2.0.107, 4.3.0 before 4.3.0.21
• Open Banking AM 2.0.0 before 2.0.0.325
• Open Banking IAM 2.0.0 before 2.0.0.345
• Identity Server as Key Manager 5.10.0 before 5.10.0.292
• Identity Server 5.10.0 before 5.10.0.296, 5.11.0 before 5.11.0.336, 6.0.0 before 6.0.0.188, 6.1.0 before 6.1.0.148, 7.0.0 before 7.0.0.15
• Carbon User Manager Kernel 4.5.0 before 4.5.0.4, 4.5.3 before 4.5.3.34, 4.6.0 before 4.6.0.141, 4.6.1 before 4.6.1.108, 4.6.2 before 4.6.2.610, 4.6.3 before 4.6.3.23, 4.6.4 before 4.6.4.5, 4.7.1 before 4.7.1.51, 4.8.1 before 4.8.1.23, 4.9.0 before 4.9.0.54, 4.9.26 before 4.9.26.13, 4.10.9 before 4.10.9.10

Fixed in

• Apply the update levels listed in the vendor's CVE record: Enterprise Integrator 6.6.0.204, API Manager 3.1.0.275 / 3.2.0.365 / 3.2.1.19 / 4.0.0.308 / 4.1.0.170 / 4.2.0.107 / 4.3.0.21, Open Banking AM 2.0.0.325, Open Banking IAM 2.0.0.345, Identity Server as Key Manager 5.10.0.292, Identity Server 5.10.0.296 / 5.11.0.336 / 6.0.0.188 / 6.1.0.148 / 7.0.0.15, Carbon User Manager Kernel as listed under affected versions
• Updates are delivered through the vendor's update mechanism; WSO2 Updates requires a subscription

Workaround

Unknown. No vendor-confirmed interim workaround was found. The vendor advisory recommends migrating to an unaffected version.

Exploitation

• No active exploitation known at the time of writing.
• CISA SSVC assessment: Exploitation none, automatable yes, technical impact total.
• No public proof of concept found in primary sources.

Our recommendation

• Check which WSO2 products and versions are in use and compare them with the fixed versions above.
• Patch in the next maintenance window, or sooner if the Management Console is exposed.
• Restrict access to the Management Console to trusted administration networks and do not expose it to the internet.
• Review administrator accounts: enforce MFA, use strong passwords and apply least privilege.
• Monitor the console and logs for unusual changes to user store configuration.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• WSO2 Security Advisory WSO2-2023-3084 (2026 path from CVE reference) security.docs.wso2.com
• WSO2 Security Advisory WSO2-2023-3084 (2025 path) security.docs.wso2.com
• WSO2 carbon-kernel pull request #4067 github.com
• OpenCVE CVE-2024-4457 app.opencve.io
• The Hacker Wire CVE-2024-4457 www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:22.