Is CVE-2025-9955 actively exploited?

CVE-2025-9955 has no public evidence of in-the-wild exploitation as of 2025-10-21.

What is the CVSS score for CVE-2025-9955?

CVE-2025-9955 has a CVSS score of 5.7 (MEDIUM severity). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

How do I patch CVE-2025-9955?

Patch guidance is available from wso2 security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2025-9955.

CVE-2025-9955 - remediation guidance & executive summary

Q: Which products are affected by CVE-2025-9955?

9 products: wso2 enterprise integrator, wso2 enterprise integrator, wso2 enterprise integrator, wso2 enterprise integrator, wso2 enterprise integrator, and 4 more.

Description

An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational details, which could aid in further exploitation or reconnaissance.

CVSS Metrics

Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector: adjacent network
Complexity: low
Privileges: low
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Weaknesses: CWE-863 · Incorrect Authorization

Metadata

Primary Vendor: WSO2
Published: 10/16/2025
Last Modified: 10/21/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

wso2 : enterprise_integratorwso2 : enterprise_integratorwso2 : enterprise_integratorwso2 : enterprise_integratorwso2 : enterprise_integratorwso2 : enterprise_integratorwso2 : enterprise_integratorwso2 : enterprise_integratorwso2 : enterprise_service_bus

Remediation Guidance

Executive Summary

View on NIST NVD