All vulnerabilities
CVE-2024-4457

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

WSO2 WSO2 Enterprise Integrator
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.6.0.204Also 3.1.0.275, 3.2.0.365 and 25 moreCVE List
Published18 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

Show all 28 fixed versions
  • 4.2.0.107WSO2 API ManagerCVE List
  • 4.3.0.21WSO2 API ManagerCVE List
  • 2.0.0.325WSO2 Open Banking AMCVE List
  • 2.0.0.345WSO2 Open Banking IAMCVE List
  • 5.10.0.292WSO2 Identity Server as Key ManagerCVE List
  • 5.10.0.296WSO2 Identity ServerCVE List
  • 5.11.0.336WSO2 Identity ServerCVE List
  • 6.0.0.188WSO2 Identity ServerCVE List
  • 6.1.0.148WSO2 Identity ServerCVE List
  • 7.0.0.15WSO2 Identity ServerCVE List
  • 4.5.0.4WSO2 Carbon User Manager KernelCVE List
  • 4.5.3.34WSO2 Carbon User Manager KernelCVE List
  • 4.6.0.141WSO2 Carbon User Manager KernelCVE List
  • 4.6.1.108WSO2 Carbon User Manager KernelCVE List
  • 4.6.2.610WSO2 Carbon User Manager KernelCVE List
  • 4.6.3.23WSO2 Carbon User Manager KernelCVE List
  • 4.6.4.5WSO2 Carbon User Manager KernelCVE List
  • 4.7.1.51WSO2 Carbon User Manager KernelCVE List
  • 4.8.1.23WSO2 Carbon User Manager KernelCVE List
  • 4.9.0.54WSO2 Carbon User Manager KernelCVE List
  • 4.9.26.13WSO2 Carbon User Manager KernelCVE List
  • 4.10.9.10WSO2 Carbon User Manager KernelCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.

Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.

Text from CVE List

Affected versions 35

  • WSO2 Enterprise Integratorunknown: all versions before 6.6.0CVE List
  • WSO2 Enterprise Integratoraffected: 6.6.0 before 6.6.0.204CVE List
  • WSO2 API Managerunknown: all versions before 3.1.0CVE List
  • WSO2 API Manageraffected: 3.1.0 before 3.1.0.275CVE List
  • WSO2 API Manageraffected: 3.2.0 before 3.2.0.365CVE List
  • WSO2 API Manageraffected: 3.2.1 before 3.2.1.19CVE List
  • WSO2 API Manageraffected: 4.0.0 before 4.0.0.308CVE List
  • WSO2 API Manageraffected: 4.1.0 before 4.1.0.170CVE List
  • WSO2 API Manageraffected: 4.2.0 before 4.2.0.107CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.21CVE List
  • WSO2 Open Banking AMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking AMaffected: 2.0.0 before 2.0.0.325CVE List
  • WSO2 Open Banking IAMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking IAMaffected: 2.0.0 before 2.0.0.345CVE List
  • WSO2 Identity Server as Key Managerunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Server as Key Manageraffected: 5.10.0 before 5.10.0.292CVE List
  • WSO2 Identity Serverunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Serveraffected: 5.10.0 before 5.10.0.296CVE List
  • WSO2 Identity Serveraffected: 5.11.0 before 5.11.0.336CVE List
  • WSO2 Identity Serveraffected: 6.0.0 before 6.0.0.188CVE List
  • WSO2 Identity Serveraffected: 6.1.0 before 6.1.0.148CVE List
  • WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.15CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.5.0 before 4.5.0.4CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.5.3 before 4.5.3.34CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.6.0 before 4.6.0.141CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.6.1 before 4.6.1.108CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.6.2 before 4.6.2.610CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.6.3 before 4.6.3.23CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.6.4 before 4.6.4.5CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.7.1 before 4.7.1.51CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.8.1 before 4.8.1.23CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.9.0 before 4.9.0.54CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.9.26 before 4.9.26.13CVE List
  • WSO2 Carbon User Manager Kernelaffected: 4.10.9 before 4.10.9.10CVE List
  • WSO2 Carbon User Manager Kernelunaffected: 4.9.27CVE List

References 2