The Management Console fails to properly validate input related to the configuration of JDBC user stores
WSO2 · WSO2 Enterprise Integrator
The Management Console of WSO2 Enterprise Integrator fails to properly validate input used when configuring JDBC user stores, which is an OS command injection weakness. An attacker with network access to the console, requiring no authentication and no user interaction, can submit specially crafted input to execute arbitrary code on the server with the privileges of the WSO2 product, potentially leading to full system compromise.
The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 18 Oct 2026. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 4 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Known_Cve | Oct 27, 2026 | Part 1/326 Oct 2026
- Known_Cve | Oct 24, 2026 | Part 1/323 Oct 2026
- Known_Cve | Oct 23, 2026 | Part 2/322 Oct 2026
- Known_Cve | Oct 22, 2026 | Part 3/421 Oct 2026