Skip to main content

Wso2

Vendor security scorecard – 6 CVEs in the selected period

Period: 30d 90d 6m 1y All
Risk 12
6
CVEs
0
Critical
3
High
0
KEV
0
PoC
1
Unpatched C/H
83.3%
Patch Rate
0.2%
Avg EPSS

Severity Breakdown

CRITICAL
0
HIGH
3
MEDIUM
2
LOW
1

Monthly CVE Trend

Top Risky CVEs

CVE Summary Severity CVSS EPSS Priority Signals
CVE-2025-12737 OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems. HIGH 8.4 0.2% 42
CVE-2026-3416 Predictable HMAC shared secrets generated by the API Publisher component of WSO2 API Manager allow a sophisticated attacker to forecast future webhook signing secrets and forge event payloads that the API Gateway accepts as authentic. All supported release lines are affected — API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0 and 4.5.0, plus API Control Plane 4.5.0 — with fixes shipped as vendor update levels (for example 4.4.0.68, 4.3.0.104, 4.5.0.52 and 4.1.0.253). Exploitation is not currently observed: EPSS is only 0.27% (19th percentile), CISA's SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so the practical risk is driven by the sensitivity of the webhook-integrated downstream systems rather than by mass scanning activity. HIGH 7.5 0.3% 38
CVE-2026-19515 A command injection flaw in the WSO2 Integrator MI extension for Visual Studio Code lets a crafted Micro Integrator project run arbitrary operating system commands when its unit test execution flow is triggered. Exploitation is not remote or silent: the developer must open the untrusted project, explicitly grant it workspace trust, and then run the project's unit tests, after which injected commands execute with the privileges of the VS Code user (CVSS 3.1 base 7.0, AV:L/AC:H/PR:N/UI:R). Impact is therefore bounded by the developer workstation's account privileges, and no public exploit code or active exploitation is indicated in the available intelligence. HIGH 7.0 0.2% 35
No patch
CVE-2025-5802 The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis. MEDIUM 5.3 0.3% 26
CVE-2026-3096 Reverse tabnapping in WSO2 API Manager and WSO2 API Control Plane exposes authenticated users to window-context hijacking when the portal opens external links without nullifying the JavaScript `window.opener` reference. An attacker who can surface a malicious external link within the portal - via API documentation fields, link-accepting content areas, or other user-controlled inputs - can redirect the user's original authenticated portal tab to an attacker-controlled phishing page once the external link is clicked. The vendor has published advisory WSO2-2026-5164; no public exploit code and no CISA KEV listing have been identified at time of analysis. MEDIUM 4.7 0.2% 24
CVE-2025-13166 WSO2 Identity Server exposes a user-enumeration weakness in its SMS OTP login flow: the error messages returned when the OTP challenge is initiated differ depending on whether the supplied account exists, giving unauthenticated remote attackers a way to confirm valid usernames. The signal is strongest for accounts that have no mobile number registered, which produce a distinct response. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is only 3.7 — the practical value to an attacker is the harvested username list, which feeds later brute-force and social-engineering campaigns rather than yielding direct compromise. LOW 3.7 0.3% 19

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy