CVE-2025-11093

CVE-2025-11093, published on 2025-11-05, is an arbitrary code execution vulnerability (CWE-94) with a CVSS v3.1 score of 8.4 (AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) affecting multiple WSO2 products, including WSO2 Micro Integrator, WSO2 Enterprise Integrator, and WSO2 API Manager. The flaw arises from insufficient restrictions in the GraalJS and NashornJS Script Mediator engines, enabling authenticated users with elevated privileges to execute arbitrary code within the integration runtime environment.

Attackers require adjacent network access and high privileges to exploit this vulnerability with low complexity and no user interaction. By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager it extends to both administrators and API creators. Successful exploitation allows trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.

For details on mitigation, patches, and remediation steps, refer to the WSO2 security advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4510/.