WSO2 API Manager CVE-2026-4249

Exploitation requires network reachability to the throttling event handling mechanism of a WSO2 API management product (API Manager, Universal Gateway, Traffic Manager, or API Control Plane) that accepts and processes JSON throttling-event payloads. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special product configuration beyond the default distributed-throttling event pathway are required - the attacker only needs to deliver a malicious JSON payload to the throttling event interface. The primary limiting factor is whether that throttling/Traffic Manager channel is exposed to the attacker's network position: in deployments where the throttling event endpoint is segregated on an internal management network, an external unauthenticated attacker cannot reach it, which materially reduces real-world exposure below what the AV:N metric alone implies.

This is a genuine operational priority for anyone exposing WSO2 API Manager/Gateway to untrusted networks. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H scores 8.6 (High) and every attacker-favorable metric is present: network reachable, low complexity, no privileges, no user interaction, with high availability impact and a scope change amplifying blast radius. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; likewise there is no POC and no CISA KEV listing, so despite the trivial exploitability the vulnerability is not confirmed to be under active exploitation - treat it as high-likelihood-if-targeted rather than mass-exploited. The one signal to verify is whether the throttling event endpoint is actually exposed on network interfaces reachable by unauthenticated attackers in a given deployment; CVSS asserts AV:N/PR:N, but in hardened topologies the Traffic Manager throttling channel may sit on an internal network - verify exposure with the vendor advisory and your network segmentation before downgrading urgency.

An attacker on the network sends a crafted, structurally malformed JSON throttling-event payload to an exposed WSO2 throttling endpoint without any authentication. The malformed data is processed by the throttling event handler and drives the API Gateway into a broken state that persists across the request, so legitimate API calls stop being served until an operator manually restarts or repairs the affected nodes. No public exploit code has been identified, but the low attack complexity (AC:L) and lack of required privileges or user interaction make reliable exploitation straightforward once the endpoint is reachable.