What is the CVSS score of CVE-2026-4249?

CVE-2026-4249 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of WSO2 API Manager are affected by CVE-2026-4249?

CVE-2026-4249 affects WSO2 API infrastructure products (API Manager, Universal Gateway, Traffic Manager, API Control Plane), allowing any unauthenticated attacker to crash the API Gateway tier with a…. A patch is available.

How to fix or mitigate CVE-2026-4249?

Within 24 hours: Inventory all WSO2 product instances in production and assess API traffic volume to determine blast radius. Within 7 days: Implement input validation for JSON payloads to the throttling event handler and deploy network-level rate limiting to restrict incoming requests from untrusted sources. Within 30 days: Contact WSO2 for patch timeline; establish automated failover to standby API Gateway clusters and deploy WAF rules to detect and block malicious JSON payloads matching known attack patterns.

WSO2 API Manager CVE-2026-4249

EUVD-2026-41871 HIGH

Improper Neutralization (CWE-707)

2026-07-06 WSO2

GHSA-7469-8h9r-c5xc

Denial Of Service Wso2 Universal Gateway Wso2 Traffic Manager Wso2 Api Control Plane Wso2 Api Manager

8.6

CVSS 3.1 · Vendor: WSO2

Severity by source

Vendor (WSO2) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

8.6 HIGH

Unauthenticated network-reachable throttling endpoint (AV:N/PR:N/AC:L), no user interaction, availability-only impact with scope change since one component's input takes down the separate Gateway (S:C/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (WSO2).

CVSS VectorVendor: WSO2

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 06, 2026 - 12:01 EUVD

Analysis Generated

Jul 06, 2026 - 10:57 vuln.today

DescriptionCVE.org

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.

Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.

AnalysisAI

Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffic Manager, and WSO2 API Control Plane - allows an unauthenticated remote attacker to send malicious JSON payloads to the throttling event handling mechanism, crashing or corrupting API Gateway state so that legitimate API traffic can no longer be processed. Because the outage is persistent and requires manual intervention to restore service, and the CVSS scope is changed (S:C), a single request can take down the entire API Gateway tier. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected component is WSO2's distributed throttling subsystem, which coordinates rate-limiting decisions across the API Gateway and Traffic Manager by exchanging throttling event messages. These products deserialize user-influenced JSON payloads representing throttling events but fail to sufficiently validate their structure and content before processing, which is the CWE-707 (Improper Neutralization / improper enforcement of message integrity) root cause: untrusted input is accepted into an internal control channel that assumes well-formed data. The CPE data confirms the affected products are wso2:wso2_api_manager, wso2:wso2_universal_gateway, wso2:wso2_traffic_manager, and wso2:wso2_api_control_plane (all versions per the wildcard CPEs), reflecting that the throttling event handler is shared code across WSO2's API management stack. The CVSS scope change (S:C) reflects that a request handled by one component (the vulnerable authorization/throttling context) impacts the availability of a separate downstream component - the Gateway serving all API traffic.

RemediationAI

Apply the fix described in the WSO2 vendor advisory WSO2-2026-5236 (https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/); a patch is available per the vendor advisory, but an exact fixed version string is not present in the provided data and should be taken directly from that advisory or the corresponding WSO2 update level / WUM patch for your product version. As a compensating control until patched, restrict network access to the throttling event handling interface and the Traffic Manager messaging channel so only trusted Gateway and Traffic Manager nodes can reach it (via firewall rules or network segmentation), which removes unauthenticated external reachability at the cost of requiring accurate inventory of legitimate inter-node traffic. Additionally, place the API Gateway behind a WAF or reverse proxy that validates and constrains inbound JSON payload structure to the throttling endpoints, accepting that overly strict filtering could reject legitimate throttling events; if distributed throttling is not required, consider disabling the Traffic Manager integration, noting this removes centralized rate-limiting capability.