35
CVEs
4
Critical
8
High
0
KEV
1
PoC
1
Unpatched C/H
94.3%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
8
MEDIUM
18
LOW
5
Monthly CVE Trend
Affected Products (30)
Api Manager
53
Identity Server
49
Identity Server As Key Manager
33
Enterprise Integrator
25
Wso2 Api Manager
22
Wso2 Identity Server
22
Open Banking Iam
17
Wso2 Api Control Plane
13
Api Control Plane
12
Open Banking Am
12
Wso2 Traffic Manager
11
Wso2 Universal Gateway
11
Wso2 Open Banking Iam
10
Traffic Manager
10
Api Microgateway
10
Wso2 Identity Server As Key Manager
10
Universal Gateway
9
Wso2 Open Banking Am
9
Api Manager Analytics
9
Identity Server Analytics
9
Iot Server
7
Open Banking Km
6
Data Analytics Server
6
Micro Integrator
4
Dashboard Server
4
Open Redirect
3
Wso2 Carbon Identity Application Authentication Framework
3
Wso2 Carbon Api Manager Rest Api Utility
3
Carbon
3
Wso2 Carbon Magiclink Authenticator Module
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-5430 | Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis. | CRITICAL | 10.0 | 0.2% | 50 |
PoC
|
| CVE-2026-2053 | Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making server-initiated requests to attacker-chosen destinations by injecting crafted WS-Addressing headers into the message flow. Because the API Manager typically sits at the network edge with reachability into internal systems, this allows pivoting to otherwise unreachable internal resources and services. The vendor rates it CVSS 10.0; it is not in CISA KEV and no public exploit identified at time of analysis, with a low EPSS of 0.20% (10th percentile). | CRITICAL | 10.0 | 0.2% | 50 |
|
| CVE-2026-1728 | Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2025-15039 | Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM, Traffic Manager, Universal Gateway, API Control Plane, Identity Server as Key Manager) lets an attacker skip intermediate multi-factor challenges when the Conditional (Adaptive) Authentication script is configured with a particular multi-step callback/re-execution pattern, resulting in unauthorized takeover of a targeted user account. The flaw stems from the adaptive script failing to enforce completion of all required steps, and carries a high CVSS of 9.4 (C:H/I:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the affected components underpin enterprise SSO/MFA and open-banking IAM, making impact severe where the vulnerable flow exists. | CRITICAL | 9.4 | 0.4% | 47 |
|
| CVE-2026-4249 | Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffic Manager, and WSO2 API Control Plane - allows an unauthenticated remote attacker to send malicious JSON payloads to the throttling event handling mechanism, crashing or corrupting API Gateway state so that legitimate API traffic can no longer be processed. Because the outage is persistent and requires manual intervention to restore service, and the CVSS scope is changed (S:C), a single request can take down the entire API Gateway tier. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV. | HIGH | 8.6 | 0.3% | 43 |
|
| CVE-2025-10470 | Memory exhaustion denial-of-service in WSO2 Identity Server's Magic Link authenticator allows remote unauthenticated attackers to crash the authentication service by flooding invalid login requests without rate limiting. The vulnerability affects deployments using the Magic Link authentication flow and has an EPSS score indicating moderate exploitation likelihood. WSO2 has published a security advisory (WSO2-2025-4469) with remediation guidance for affected Identity Server and Carbon MagicLink Authenticator Module installations. | HIGH | 8.6 | 0.0% | 43 |
|
| CVE-2025-12737 | OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems. | HIGH | 8.4 | 0.2% | 42 |
|
| CVE-2026-3416 | Predictable HMAC shared secrets generated by the API Publisher component of WSO2 API Manager allow a sophisticated attacker to forecast future webhook signing secrets and forge event payloads that the API Gateway accepts as authentic. All supported release lines are affected — API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0 and 4.5.0, plus API Control Plane 4.5.0 — with fixes shipped as vendor update levels (for example 4.4.0.68, 4.3.0.104, 4.5.0.52 and 4.1.0.253). Exploitation is not currently observed: EPSS is only 0.27% (19th percentile), CISA's SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so the practical risk is driven by the sensitivity of the webhook-integrated downstream systems rather than by mass scanning activity. | HIGH | 7.5 | 0.3% | 38 |
|
| CVE-2024-2374 | The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing. | HIGH | 7.5 | 0.0% | 38 |
|
| CVE-2025-10908 | Account-lockout bypass in WSO2 Identity Server (6.0.0, 6.1.0, 7.0.0, 7.1.0) and the Carbon MagicLink Authenticator Module allows accounts that have been administratively or automatically locked to still authenticate through the Magic Link and Passkey (FIDO2) flows, because those paths do not validate account state. An attacker in possession of a valid magic link or passkey for a locked account can reach the application and its sensitive data despite the lock, and the lockout control intended to stop further login attempts is rendered ineffective. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and the flaw is not in CISA KEV. | HIGH | 7.3 | 0.0% | 37 |
|
| CVE-2026-19515 | A command injection flaw in the WSO2 Integrator MI extension for Visual Studio Code lets a crafted Micro Integrator project run arbitrary operating system commands when its unit test execution flow is triggered. Exploitation is not remote or silent: the developer must open the untrusted project, explicitly grant it workspace trust, and then run the project's unit tests, after which injected commands execute with the privileges of the VS Code user (CVSS 3.1 base 7.0, AV:L/AC:H/PR:N/UI:R). Impact is therefore bounded by the developer workstation's account privileges, and no public exploit code or active exploitation is indicated in the available intelligence. | HIGH | 7.0 | 0.2% | 35 |
No patch
|
| CVE-2025-9973 | WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentication flow execution, allowing privileged users in one organization to trigger authentication logic on other organizations. An attacker with adaptive authentication configuration privileges can exploit this context validation gap to bypass authorization boundaries, escalate privileges, and gain unauthorized access to user accounts and resources across organizational boundaries. | MEDIUM | 6.4 | 0.0% | 32 |
|
| CVE-2025-8325 | Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to invoke Gateway and Internal Service APIs without proper permission enforcement, enabling unauthorized operations on sensitive REST API endpoints. The vulnerability affects multiple WSO2 products including API Control Plane, Universal Gateway, and Traffic Manager. CVSS 6.3 (network-accessible, low complexity, requires valid user credentials) indicates moderate severity with clear lateral privilege escalation potential in multi-tenant environments. | MEDIUM | 6.3 | 0.0% | 32 |
|
| CVE-2025-8591 | Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, API Control Plane, Traffic Manager, Universal Gateway, Open Banking AM/IAM, and Identity Server as Key Manager - allows unauthenticated remote attackers to inject arbitrary script via unsanitized URL parameters. An attacker who tricks an authenticated user into clicking a crafted link can redirect the victim to a malicious site, tamper with rendered page content, or exfiltrate non-session browser data; partial mitigation is provided by httpOnly flags on session cookies, which block direct session token theft. No public exploit identified at time of analysis; WSO2 self-reported the issue and published advisory WSO2-2025-4343. | MEDIUM | 6.1 | 0.2% | 31 |
|
| CVE-2026-2445 | Reflected cross-site scripting in a WSO2 product allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing an unsanitized parameter. When a victim user clicks the attacker-controlled link, the injected script executes in the victim's browser under the application's origin, enabling UI manipulation, phishing redirects, and extraction of non-cookie browser data. Session hijacking impact is partially mitigated because session cookies are protected by the httpOnly flag, though other sensitive browser-accessible data remains at risk. No public exploit or KEV listing has been identified at time of analysis. | MEDIUM | 6.1 | 0.1% | 31 |
|