WSO2 Identity Server is affected by a critical template injection vulnerability that enables remote code execution for authenticated administrators.

This vulnerability (CWE-1336) involves improper neutralization of special elements within a third-party Velocity template engine, allowing an authenticated administrator to execute arbitrary template code on the underlying server.

Successful exploitation allows an attacker with administrative access to achieve remote code execution, leading to full system compromise. Given the CVSS score of 10.0, this represents an extreme risk to confidentiality, integrity, and availability, potentially allowing an attacker to move laterally within the network or exfiltrate identity-related sensitive data.

Immediate Action: Update WSO2 Identity Server to version 5.11.0.299 or later as per the vendor's security advisory.

Proactive Monitoring: Monitor server logs for unauthorized modifications to template files and anomalous execution patterns originating from administrative sessions.

Compensating Controls: Ensure strict access control lists (ACLs) for administrative panels and utilize a Web Application Firewall (WAF) to detect and block suspicious template syntax patterns.

Public Exploit Available: Unknown

The severity of this flaw cannot be overstated, as it provides a direct path to total system takeover for anyone possessing administrative credentials. Administrators must prioritize applying the vendor-provided patch immediately to eliminate the underlying template engine vulnerability.