WSO2 Vulnerabilities and Affected Products

Products

WSO2 API Manager64 vulnerabilities
WSO2 Identity Server59 vulnerabilities
WSO2 Identity Server as Key Manager36 vulnerabilities
WSO2 Open Banking IAM34 vulnerabilities
WSO2 API Control Plane33 vulnerabilities
WSO2 Open Banking AM30 vulnerabilities
WSO2 Traffic Manager30 vulnerabilities
WSO2 Universal Gateway29 vulnerabilities
WSO2 Enterprise Integrator23 vulnerabilities
WSO2 Open Banking KM8 vulnerabilities
WSO2 Micro Integrator7 vulnerabilities
WSO2 Carbon API Management Implementation5 vulnerabilities
WSO2 Carbon API Manager Rest API Utility4 vulnerabilities
WSO2 Enterprise Mobility Manager4 vulnerabilities
org.wso2.carbon:org.wso2.carbon.base3 vulnerabilities
org.wso2.carbon:org.wso2.carbon.ui3 vulnerabilities
WSO2 Carbon Identity Application Authentication Framework3 vulnerabilities
WSO2 Carbon MagicLink Authenticator Module3 vulnerabilities
WSO2 Enterprise Service Bus3 vulnerabilities
WSO2 IS as Key Manager3 vulnerabilities
api_manager2 vulnerabilities
carbon-registry2 vulnerabilities
Email OTP Authenticator2 vulnerabilities
org.wso2.carbon:org.wso2.carbon.server.admin2 vulnerabilities
WSO2 API Manager Analytics2 vulnerabilities

WSO2 vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-3418CRITICAL	Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution… CWE-434Aug 6, 2026	CVSS9.1v3.1	EPSS0.521%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-3415HIGH	XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible w… CWE-776Aug 6, 2026	CVSS8.7v3.1	EPSS0.342%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-14561CRITICAL	Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments. CWE-284Aug 6, 2026	CVSS9.0v3.1	EPSS0.386%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-5430CRITICAL	Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:… CWE-347Aug 6, 2026	CVSS10.0v3.1	EPSS0.223%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-1728CRITICAL	Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it. CWE-269Aug 6, 2026	CVSS9.8v3.1	EPSS0.297%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-15039CRITICAL	Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This v… CWE-693Aug 6, 2026	CVSS9.4v3.1	EPSS0.372%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-0637MEDIUM	Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access. CWE-532Aug 6, 2026	CVSS4.4v3.1	EPSS0.113%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-13394MEDIUM	Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingl… CWE-352Aug 6, 2026	CVSS5.4v3.1	EPSS0.097%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-10302MEDIUM	Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interfa… CWE-20Aug 6, 2026	CVSS4.0v3.1	EPSS0.174%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-6832MEDIUM	Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores ar… CWE-693Aug 6, 2026	CVSS5.9v3.1	EPSS0.241%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-8995MEDIUM	Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and … CWE-613Aug 6, 2026	CVSS4.9v3.1	EPSS0.119%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-2445MEDIUM	Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as … CWE-79Jul 20, 2026	CVSS6.1v3.1	EPSS0.149%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-4249HIGH	Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is… CWE-707Jul 6, 2026	CVSS8.6v3.1	EPSS0.339%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-8591MEDIUM	Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on sessio… CWE-79Jul 6, 2026	CVSS6.1v3.1	EPSS0.161%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-8325MEDIUM	Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could… CWE-281May 11, 2026	CVSS6.3v3.1	EPSS0.174%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-8154MEDIUM	HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie va… CWE-74May 11, 2026	CVSS5.3v3.1	EPSS0.186%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-13590CRITICAL	Authenticated arbitrary file upload via a System REST API requiring administrator permission. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload. CWE-434Feb 19, 2026	CVSS9.1v3.1	EPSS0.676%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-9312CRITICAL	Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP serv… CWE-306Nov 18, 2025	CVSS9.8v3.1	EPSS0.238%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-6670HIGH	Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective in this context because it allows cookies to be sent with cross-origin top-level navigations using GET requests. A malicious actor can exploit this vulnerability by tricking an aut… CWE-352Nov 18, 2025	CVSS8.8v3.1	EPSS0.218%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-10853MEDIUM	Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates… CWE-79Nov 5, 2025	CVSS5.2v3.1	EPSS0.181%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-5770MEDIUM	Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. However, session-related cookies are protected… CWE-79Nov 5, 2025	CVSS6.1v3.1	EPSS0.2%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-11093HIGH	Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This m… CWE-94Nov 5, 2025	CVSS8.4v3.1	EPSS0.439%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-10907HIGH	Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with admin… CWE-434Nov 5, 2025	CVSS8.4v3.1	EPSS0.556%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-10713MEDIUM	XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable. CWE-611Nov 5, 2025	CVSS6.5v3.1	EPSS0.424%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-3125MEDIUM	Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE). This functionality is restricted by default to admin users; therefore, successful exploitation requires valid credentials with administrative permissions. CWE-434Nov 5, 2025	CVSS6.7v3.1	EPSS0.855%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX