The vulnerability resides in the BPMN System REST APIs where input parameters are not adequately validated. An authenticated user can send crafted requests that cause the server to execute arbitrary commands. Because the commands run with the privileges of the product’s runtime account, the potential impact ranges from moderate to catastrophic depending on the permissions granted to that account.

The affected products are WSO2 Business Process Server and the WSO2 Enterprise Integrator (BPS profile). No specific product versions are listed in the data; all supported releases remain potentially vulnerable until corrected.

The CVSS score of 8.8 indicates high severity. EPSS information is not available, and the issue is not listed in CISA KEV. Exploitation is possible only by users who have already authenticated to the REST interfaces, so the attack vector is likely local or internal. Once authenticated, an attacker can run commands that persist with the server’s runtime privileges.