Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
WSO2 marked the affected products as already unsupported when this CVE was assigned. A patch may not be available. Review the vendor references for migration or mitigation guidance.
This tag describes support at assignment time, not current support for every related product.
Impact
WSO2 Enterprise Integrator (BPS profile) and Business Process Server have a vulnerability where authenticated users can execute arbitrary commands due to insufficient input validation in BPMN System REST APIs. Affected versions are 0 to 6.6.0 and 0 to 3.6.0 respectively. The impact depends on the runtime account's permissions.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/#solution
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
WSO2 · WSO2
Enterprise Integrator (BPS profile)
1 range
WSO2 · WSO2
Enterprise Integrator (BPS profile)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → through 6.6.0
custom versions
Other versions: unknown
WSO2 · WSO2
Business Process Server
1 range
WSO2 · WSO2
Business Process Server
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → through 3.6.0
custom versions
Other versions: unaffected
Original source description
The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server.
An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-78674View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
WSO2 · platform conditions
Any condition may hold
Any condition may hold
Vulnerable product
cpe:2.3:a:wso2:enterprise_integrator_bps_profile_:*:*:*:*:*:*:*:*From (inclusive): 0
Through (inclusive): 6.6.0
Any condition may hold
Vulnerable product
cpe:2.3:a:wso2:business_process_server:*:*:*:*:*:*:*:*From (inclusive): 0
Through (inclusive): 3.6.0
Original applicability statements
[
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:enterprise_integrator_bps_profile_:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndIncluding": "6.6.0"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:business_process_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndIncluding": "3.6.0"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.