WSO2 Vulnerabilities and Affected Products
Vulnerabilities associated with org.wso2.carbon:org.wso2.carbon.base.
Products
Clear product- WSO2 API Manager64 vulnerabilities
- WSO2 Identity Server59 vulnerabilities
- WSO2 Identity Server as Key Manager36 vulnerabilities
- WSO2 Open Banking IAM34 vulnerabilities
- WSO2 API Control Plane33 vulnerabilities
- WSO2 Open Banking AM30 vulnerabilities
- WSO2 Traffic Manager30 vulnerabilities
- WSO2 Universal Gateway29 vulnerabilities
- WSO2 Enterprise Integrator23 vulnerabilities
- WSO2 Open Banking KM8 vulnerabilities
- WSO2 Micro Integrator7 vulnerabilities
- WSO2 Carbon API Management Implementation5 vulnerabilities
- WSO2 Carbon API Manager Rest API Utility4 vulnerabilities
- WSO2 Enterprise Mobility Manager4 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.base3 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.ui3 vulnerabilities
- WSO2 Carbon Identity Application Authentication Framework3 vulnerabilities
- WSO2 Carbon MagicLink Authenticator Module3 vulnerabilities
- WSO2 Enterprise Service Bus3 vulnerabilities
- WSO2 IS as Key Manager3 vulnerabilities
- api_manager2 vulnerabilities
- carbon-registry2 vulnerabilities
- Email OTP Authenticator2 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.server.admin2 vulnerabilities
- WSO2 API Manager Analytics2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-10907HIGH | Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionAn arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with admin… CWE-434Nov 5, 2025 | CVSS8.4v3.1 | EPSS0.556% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-9804CRITICAL | Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIsAn improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected. CWE-284Oct 16, 2025 | CVSS9.6v3.1 | EPSS0.521% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-9955MEDIUM | Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store ConfigurationAn improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational d… CWE-863Oct 16, 2025 | CVSS5.7v3.1 | EPSS0.193% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |