WSO2

Vulnerability activity for WSO2: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 8
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 9
Critical (CVSS 9+): 2
Exploited (CISA KEV): 1
With exploit code: 0

Last 365 days

CVEs: 9
Critical (CVSS 9+): 2
Exploited (CISA KEV): 1
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

10.0CriticalSep 24, 2026WSO2 Multiple Products Crypto / certificateCVE-2026-5430WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. Added to KEV Sep 24, 2026Exploited
9.8CriticalApr 18, 2022WSO2 Multiple Products Path traversal / file handlingCVE-2022-29464Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.Added to KEV Apr 25, 2022 · 7 days after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection

Recent

–UnscoredOct 21, 2026WSO2 Identity ServerCVE-2025-0326The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions. The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are
5.8MediumOct 21, 2026WSO2 API ManagerCVE-2024-7478When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store. The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leak
4.0MediumOct 21, 2026WSO2 API ManagerCVE-2024-6423The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of
4.8MediumOct 21, 2026WSO2 Identity Server Auth bypass / access controlCVE-2024-5563Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, if successful, can lead to unauthorized access to user accounts and sensitive information by systematically attempting various credential combinations.
6.1MediumOct 21, 2026WSO2 Enterprise Integrator XSSCVE-2024-5139The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, sessio
5.4MediumOct 21, 2026WSO2 API ManagerCVE-2024-4989The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.
2.7LowOct 19, 2026WSO2 Enterprise Integrator Code / command injectionCVE-2024-4412The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
9.1CriticalOct 18, 2026WSO2 Enterprise Integrator Code / command injectionCVE-2024-4457The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.
10.0CriticalSep 24, 2026WSO2 Multiple Products Crypto / certificateCVE-2026-5430WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. Exploited
9.8CriticalApr 18, 2022WSO2 Multiple Products Path traversal / file handlingCVE-2022-29464Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.Exploited100% likelyExploit codeMetasploit · NucleiDetection

See every WSO2 entry on the dashboard.