WSO2 Vulnerabilities and Affected Products
Vulnerabilities associated with WSO2 Enterprise Mobility Manager.
Products
Clear product- WSO2 API Manager64 vulnerabilities
- WSO2 Identity Server59 vulnerabilities
- WSO2 Identity Server as Key Manager36 vulnerabilities
- WSO2 Open Banking IAM34 vulnerabilities
- WSO2 API Control Plane33 vulnerabilities
- WSO2 Open Banking AM30 vulnerabilities
- WSO2 Traffic Manager30 vulnerabilities
- WSO2 Universal Gateway29 vulnerabilities
- WSO2 Enterprise Integrator23 vulnerabilities
- WSO2 Open Banking KM8 vulnerabilities
- WSO2 Micro Integrator7 vulnerabilities
- WSO2 Carbon API Management Implementation5 vulnerabilities
- WSO2 Carbon API Manager Rest API Utility4 vulnerabilities
- WSO2 Enterprise Mobility Manager4 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.base3 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.ui3 vulnerabilities
- WSO2 Carbon Identity Application Authentication Framework3 vulnerabilities
- WSO2 Carbon MagicLink Authenticator Module3 vulnerabilities
- WSO2 Enterprise Service Bus3 vulnerabilities
- WSO2 IS as Key Manager3 vulnerabilities
- api_manager2 vulnerabilities
- carbon-registry2 vulnerabilities
- Email OTP Authenticator2 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.server.admin2 vulnerabilities
- WSO2 API Manager Analytics2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-9804CRITICAL | Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIsAn improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected. CWE-284Oct 16, 2025 | CVSS9.6v3.1 | EPSS0.521% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-7074MEDIUM | Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code ExecutionAn arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server. By leveraging this vulnerability, an attacker could upload a specially crafted payload, potentially achieving remote code execution (RCE) on the server. Exploitation requires valid admin credentials, limiting its impact to authorized but p… CWE-434Jun 2, 2025 | CVSS6.8v3.1 | EPSS11.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-7097MEDIUM | Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User SignupAn incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could l… | CVSS4.3v3.1 | EPSS0.606% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2024-7096MEDIUM | Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawA privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that is not part of the default WSO2 product configuration. * At least one custom role exists with non-default permissions. * The attacker … CWE-863May 30, 2025 | CVSS4.2v3.1 | EPSS0.594% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |