TI-2026-82181 Aliases CVE-2026-78674 GHSA-hqmm-q55h-r6p8

Command injection in WSO2 BPMN System REST APIs allows code execution

MEDIUM 42CWE-78Published 2026-10-28 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

WSO2 Enterprise Integrator (BPS profile) through 6.6.0 and WSO2 Business Process Server through 3.6.0 are affected. The BPMN System REST APIs do not sufficiently validate input parameters, a flaw classified as CWE-78. An authenticated user can submit crafted requests that execute arbitrary commands on the server with the privileges of the product's runtime account, so the scope of damage depends on that account's permissions.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00996 62nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WSO2	Enterprise Integrator (BPS profile)	up to 6.6.0	—	No fix listed	CNA
WSO2	Business Process Server	up to 3.6.0	—	No fix listed	CNA

Enterprise Integrator (BPS profile) VendorWSO2 Affected up to 6.6.0 Fixed in — No fix listed CNA
Business Process Server VendorWSO2 Affected up to 3.6.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for WSO2 Enterprise Integrator (BPS profile). The sources list no fixed version for WSO2 Business Process Server.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

2026-10-28 Threatist record created from CVE-2026-78674
2026-10-28 Alias added: GHSA-hqmm-q55h-r6p8
2026-10-29 CISA SSVC decision points changed
2026-10-29 Priority changed: MEDIUM → LOW
2026-10-30 Priority changed: LOW → MEDIUM

References

Advisory 1

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/

TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
TI-2020-15069 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0… CVSS 3.1CRITICAL 9.1
TI-2023-15163 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do… CVSS 3.1MEDIUM 6.1
TI-2022-04130 WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting CVSS 3.1MEDIUM 6.1

See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences