What is the CVSS score of CVE-2026-3415?

CVE-2026-3415 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of WSO2 API Manager are affected by CVE-2026-3415?

WSO2 API management products contain a high-severity XML injection vulnerability (CVE-2026-3415) that allows authenticated, privileged administrators or operators to access sensitive server files,…. A patch is available.

How to fix or mitigate CVE-2026-3415?

Within 24 hours, inventory all deployed WSO2 API Manager and Integration Suite instances to identify affected versions. Within 7 days, download the vendor-released patch and validate it in a non-production environment, verifying that XML handling and SchemaValidator Mediator functionality operate correctly. Within 30 days, deploy the patch to all production systems, prioritizing instances exposed to external API consumers.

WSO2 API Manager CVE-2026-3415

EUVD-2026-54208 HIGH

Improper Restriction of Recursive Entity References in DTDs (CWE-776)

2026-08-06 ed10eef1-636d-4fbe-9993-6890dfa878f8

GHSA-43j6-vwqq-5w56

Information Disclosure

8.7

CVSS 3.1 · Vendor: ed10eef1-636d-4fbe-9993-6890dfa878f8

Severity by source

Vendor (ed10eef1-636d-4fbe-9993-6890dfa878f8) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

vuln.today AI

8.7 HIGH

PR:H confirmed by description and CVSS; S:C reflects filesystem and SSRF impact beyond the vulnerable component; no integrity impact described.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:N

Primary rating from Vendor (ed10eef1-636d-4fbe-9993-6890dfa878f8).

CVSS VectorVendor: ed10eef1-636d-4fbe-9993-6890dfa878f8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Threat Model Generated

Aug 31, 2026 - 11:35 vuln.today

Analysis Generated

Aug 06, 2026 - 23:06 vuln.today

Patch available

Aug 06, 2026 - 23:03 EUVD

CVE Published

Aug 06, 2026 - 22:17 cve.org

HIGH 8.7

DescriptionCVE.org

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.

Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

AnalysisAI

XML External Entity (XXE) injection and recursive entity expansion in WSO2's SchemaValidator Mediator expose server-side file contents and enable SSRF across a broad range of WSO2 API management products. Exploitation requires a highly privileged actor - confirmed by PR:H in the CVSS vector - who can supply crafted XML payloads to affected mediator flows, triggering unauthorized outbound requests, server file reads, or resource exhaustion that degrades service availability. Vendor patches are available for all listed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The SchemaValidator Mediator is an XML-processing component in WSO2's integration and API management platform used to validate inbound XML payloads against schemas during mediation flows. The root cause is improper restriction of XML external entity resolution (related to CWE-611 XXE behavior) and recursive entity references (CWE-776 - 'Billion Laughs'-style entity expansion). When the XML parser processes user-supplied content without disabling DOCTYPE declarations and external entity resolution, an attacker can declare entities that reference local filesystem paths (triggering file disclosure) or remote URLs (triggering SSRF). The entity expansion variant causes the parser to recursively dereference deeply nested entity declarations, consuming excessive memory and CPU. Affected products span the WSO2 Carbon-based API Gateway, API Manager, API Control Plane, Universal Gateway, and Traffic Manager product lines across numerous minor versions as identified by EUVD-2026-54208.

RemediationAI

Patch available per vendor advisory (WSO2-2026-5001) at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/. Operators should upgrade to the remediated patch level for their respective product line: API Manager 4.6.0 to 4.6.0.16+, API Manager 4.5.0 to 4.5.0.53+, API Control Plane 4.6.0 to 4.6.0.17+, API Control Plane 4.5.0 to 4.5.0.54+, with corresponding patch thresholds for all other listed versions. Where immediate patching is not feasible, compensating controls include restricting access to the SchemaValidator Mediator administrative configuration surface to a minimal set of trusted operators and enforcing network-level egress filtering to block outbound connections from the API management host to untrusted internal or external targets - this mitigates the SSRF vector at the cost of limiting legitimate outbound integrations. Additionally, placing the API management host behind a host-based firewall that blocks loopback and RFC-1918 SSRF destinations reduces SSRF impact. File-system access hardening (running the WSO2 process under a least-privilege OS account with restricted filesystem read permissions) limits the confidentiality impact of successful XXE exploitation. These workarounds do not address the root cause and should be treated as temporary controls only.