WSO2 Business Process Server: Remote code execution via BPMN REST APIs
Summary
The BPMN System REST APIs of WSO2 Enterprise Integrator (BPS profile) and WSO2 Business Process Server do not sufficiently validate input parameters. An authenticated user can send crafted requests that lead to execution of arbitrary operating system commands on the server. The impact depends on the permissions of the product's runtime account, and the vendor states that both products have reached end of life and no longer receive security updates.
Affected
- WSO2 Enterprise Integrator (BPS profile): 6.6.0 and below
- WSO2 Business Process Server: 3.6.0 and below
Fixed in
Unknown. The vendor lists no fixed version because the affected products have reached end of life and no longer receive security updates.
Workaround
- No official workaround is known.
- Restrict network access to the BPMN REST endpoints to trusted hosts.
- Run the runtime account with the least privileges possible.
Exploitation
- No evidence of exploitation in the wild found; not listed in the CISA Known Exploited Vulnerabilities catalog.
- No public proof of concept found.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all WSO2 Enterprise Integrator (BPS profile) and Business Process Server instances.
- Restrict network access to the management and REST endpoints and review accounts that can reach them.
- Reduce the permissions of the runtime account.
- Plan a migration to a supported product release and contact WSO2 Support for guidance.
- Monitor for unusual command execution on affected hosts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WSO2 Security Advisory WSO2-2026-5692/CVE-2026-78674 security.docs.wso2.com
- CVE Program record via CVE List V5 release github.com
- VulDB CVE-2026-78674 vuldb.com
- VulDB vulnerability 428188 vuldb.com
- WSO2 documentation pull request 269 (draft) github.com
- OffSeq Radar CVE-2026-78674 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:24.
Original description (NVD)
The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.