Dashboard / CVE-2026-78674

CVE-2026-78674

HIGH
MEDIUM Priority: 0.09 BB Relevance: 68/100
Published: 2026-10-28 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the privileges of the product's runtime account. The scope of potential damage is contingent upon the permissions assigned to this account.

Weakness Classification (1)

Affected Software (8)

VendorProductVersion
WSO2 Business Process Server 0
WSO2 Business Process Server 0
WSO2 Business Process Server 0
WSO2 Business Process Server 0
WSO2 Enterprise Integrator (BPS profile) 0
WSO2 Enterprise Integrator (BPS profile) 0
WSO2 Enterprise Integrator (BPS profile) 0
WSO2 Enterprise Integrator (BPS profile) 0

References & Advisories (1)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

1.00%
Raw Score 0.009960
Percentile 62.6%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links