Following WSO2-2023-2938, WSO2 introduced a blacklist of dangerous Java classes to prevent remote code execution through Script Mediator definitions. This restriction was only applied to the Rhino engine. By specifying language="nashornJs", an attacker bypasses it entirely:
<script language="nashornJs">
var Runtime = java.lang.Runtime;
Runtime.getRuntime().exec("id");
</script>This is exploitable via any operation that deploys or modifies mediation sequences, including the APIGatewayAdmin SOAP service which lacks proper authorisation checks (CVE-2025-9804). When combined with authentication bypass vulnerabilities (CVE-2025-9152, CVE-2025-10611), this enables pre-auth remote code execution.
This vulnerability was responsibly disclosed and has been patched by the vendor.