WSO2 API Manager CVE-2025-14260

The flaw is an SSRF (CWE-918): the WSO2 product accepts user-supplied input specifying a resource location and fetches it without enforcing validation constraints, letting an attacker direct the server to arbitrary internal or external network locations and filesystem resources reachable by the server. Per the vendor CVSS vector (PR:L), exploitation requires at least low-level privileges/authentication and no user interaction (UI:N); however, the description explicitly claims an unauthenticated actor can exploit it, so the true authentication barrier is unresolved and should be confirmed with WSO2. No specific non-default configuration or feature toggle is named in the available advisory reference as a precondition. The realistic impact ceiling depends on what internal services, metadata endpoints, or files are network-reachable from the WSO2 host.

This is a genuine prioritization concern but not a drop-everything emergency on the available signals. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity SSRF requiring only low privileges, scoring 8.3 (High). The vuln.today decision label is 'this_week', consistent with a serious-but-not-active issue. Critically, there is a direct conflict between signals: the description explicitly states an 'unauthenticated actor' can exploit this, yet the vendor's own CVSS vector carries PR:L (low-privilege authenticated) - this discrepancy must be resolved with WSO2 before treating it as fully pre-auth. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV, and no proof-of-concept or exploit reference is present in the input, so there is no public exploit identified at time of analysis - this is a reported/disclosed flaw, not an observed-in-the-wild one. No SSVC automatable/technical-impact decision fields were supplied beyond the 'this_week' label. Net: credible high-severity SSRF in enterprise IAM/API infrastructure warranting prompt patching, but current evidence points to disclosure rather than widespread or targeted exploitation.

An attacker (per the vendor CVSS, holding at least low-level privileges; the description claims no authentication is needed) sends a request to an affected WSO2 endpoint with a resource-location parameter pointing at an internal service, cloud metadata endpoint, or local filesystem path. Because the product fails to validate the supplied location, the server fetches the attacker-chosen target and returns or acts on internal/external resources otherwise unreachable from outside. No public exploit is identified at time of analysis; the specific vulnerable parameter and endpoint are not detailed in the available advisory reference.