6
CVEs
0
Critical
3
High
0
KEV
0
PoC
1
Unpatched C/H
83.3%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
2
LOW
1
Monthly CVE Trend
Affected Products (30)
Api Manager
53
Identity Server
49
Identity Server As Key Manager
33
Enterprise Integrator
25
Wso2 Api Manager
22
Wso2 Identity Server
22
Open Banking Iam
17
Wso2 Api Control Plane
13
Api Control Plane
12
Open Banking Am
12
Wso2 Traffic Manager
11
Wso2 Universal Gateway
11
Wso2 Open Banking Iam
10
Traffic Manager
10
Api Microgateway
10
Wso2 Identity Server As Key Manager
10
Universal Gateway
9
Wso2 Open Banking Am
9
Api Manager Analytics
9
Identity Server Analytics
9
Iot Server
7
Open Banking Km
6
Data Analytics Server
6
Micro Integrator
4
Dashboard Server
4
Open Redirect
3
Wso2 Carbon Identity Application Authentication Framework
3
Wso2 Carbon Api Manager Rest Api Utility
3
Carbon
3
Wso2 Carbon Magiclink Authenticator Module
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-12737 | OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems. | HIGH | 8.4 | 0.2% | 42 |
|
| CVE-2026-3416 | Predictable HMAC shared secrets generated by the API Publisher component of WSO2 API Manager allow a sophisticated attacker to forecast future webhook signing secrets and forge event payloads that the API Gateway accepts as authentic. All supported release lines are affected — API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0 and 4.5.0, plus API Control Plane 4.5.0 — with fixes shipped as vendor update levels (for example 4.4.0.68, 4.3.0.104, 4.5.0.52 and 4.1.0.253). Exploitation is not currently observed: EPSS is only 0.27% (19th percentile), CISA's SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so the practical risk is driven by the sensitivity of the webhook-integrated downstream systems rather than by mass scanning activity. | HIGH | 7.5 | 0.3% | 38 |
|
| CVE-2026-19515 | A command injection flaw in the WSO2 Integrator MI extension for Visual Studio Code lets a crafted Micro Integrator project run arbitrary operating system commands when its unit test execution flow is triggered. Exploitation is not remote or silent: the developer must open the untrusted project, explicitly grant it workspace trust, and then run the project's unit tests, after which injected commands execute with the privileges of the VS Code user (CVSS 3.1 base 7.0, AV:L/AC:H/PR:N/UI:R). Impact is therefore bounded by the developer workstation's account privileges, and no public exploit code or active exploitation is indicated in the available intelligence. | HIGH | 7.0 | 0.2% | 35 |
No patch
|
| CVE-2025-5802 | The self-registration flow in WSO2 Identity Server and related WSO2 identity/API management products returns a distinct error when a submitted username already exists, letting unauthenticated users enumerate valid accounts. Any remote party who can reach the self-registration endpoint can harvest a list of confirmed usernames, which then feeds credential-stuffing, brute-force, and targeted phishing campaigns. Rated CVSS 5.3 (medium) with confidentiality-only impact; no public exploit code or active exploitation is identified in the supplied data at time of analysis. | MEDIUM | 5.3 | 0.3% | 26 |
|
| CVE-2026-3096 | Reverse tabnapping in WSO2 API Manager and WSO2 API Control Plane exposes authenticated users to window-context hijacking when the portal opens external links without nullifying the JavaScript `window.opener` reference. An attacker who can surface a malicious external link within the portal - via API documentation fields, link-accepting content areas, or other user-controlled inputs - can redirect the user's original authenticated portal tab to an attacker-controlled phishing page once the external link is clicked. The vendor has published advisory WSO2-2026-5164; no public exploit code and no CISA KEV listing have been identified at time of analysis. | MEDIUM | 4.7 | 0.2% | 24 |
|
| CVE-2025-13166 | WSO2 Identity Server exposes a user-enumeration weakness in its SMS OTP login flow: the error messages returned when the OTP challenge is initiated differ depending on whether the supplied account exists, giving unauthenticated remote attackers a way to confirm valid usernames. The signal is strongest for accounts that have no mobile number registered, which produce a distinct response. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is only 3.7 — the practical value to an attacker is the harvested username list, which feeds later brute-force and social-engineering campaigns rather than yielding direct compromise. | LOW | 3.7 | 0.3% | 19 |
|