WSO2 API Manager CVE-2026-3415

Exploitation requires a highly privileged actor - the description explicitly states 'sufficient privileges' and the CVSS vector confirms PR:H - meaning only users with administrative or equivalent access to configure and invoke SchemaValidator Mediator flows within WSO2's mediation engine are in scope. The vulnerability is only reachable via the XML and schema validation pathway of the SchemaValidator Mediator; mediator flows not using this component are not affected. There is no special network-only pre-condition beyond authenticated API management administrative access. Limiting factors include: (1) PR:H substantially restricts the exploitable population to trusted internal operators or compromised privileged accounts; (2) the mediation flow must be actively processing XML content; (3) SSRF impact depends on server egress configuration and network segmentation; (4) file read impact depends on the OS permissions of the WSO2 process account.

The CVSS 3.1 score of 8.7 reflects a Scope Change (S:C) that elevates the rating despite requiring High Privileges (PR:H), since successful exploitation reaches beyond the vulnerable component into the server filesystem and internal network. In practice, PR:H substantially reduces the exploitable population - only users with administrative or equivalent access to configure and invoke SchemaValidator Mediator flows are in scope. No EPSS data was provided in the input, and the vulnerability has not appeared in the CISA KEV catalog, nor has public proof-of-concept code been identified. The availability impact (A:H) via entity expansion is independently reachable by the same privileged actor. The real-world priority is moderate: organizations running unpatched WSO2 API management infrastructure with poorly segmented admin access should treat this as urgent, but the PR:H barrier limits opportunistic or automated exploitation. The S:C/C:H combination is the highest-concern signal because privileged but internally compromised accounts could pivot to read sensitive server files or probe internal services via SSRF, expanding the blast radius beyond the API management tier.

An attacker with administrative privileges to the WSO2 API management environment crafts an XML payload embedding a DOCTYPE declaration with an external entity reference pointing to a sensitive file such as /etc/passwd or an internal metadata service URL. The payload is submitted to a mediation flow protected by a SchemaValidator Mediator during the validation phase; the permissive XML parser resolves the entity, causing the server to read and potentially echo the file content, or to issue an outbound HTTP request to an internal network target. In a separate attack using the same access, the attacker may submit a deeply recursive entity payload to trigger resource exhaustion and degrade service availability.