WSO2 vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited WSO2 flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability Exploited since Sep 24, 2026 · CVSS 10
• CVE-2022-29464 WSO2 Multiple Products Unrestrictive Upload of FileExploited since Apr 25, 2022 · ransomware · CVSS 9.8

Latest high and critical flaws

• CVE-2026-78674 The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution High 8.8 · Oct 28, 2026
• CVE-2026-6647 In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username casHigh 7.4 · Oct 28, 2026
• CVE-2025-14260 Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expectedHigh 8.3 · Oct 28, 2026
• CVE-2025-10149 The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store.High 8.2 · Oct 19, 2026
• CVE-2024-4457 The Management Console fails to properly validate input related to the configuration of JDBC user stores.Critical 9.1 · Oct 18, 2026
• CVE-2026-19515 The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusHigh 7 · Sep 15, 2026
• CVE-2025-12737 The administrative operations within the Carbon Console do not adequately validate specific user-supplied input.High 8.4 · Sep 3, 2026
• CVE-2026-3418 The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to Critical 9.1 · Aug 6, 2026
• CVE-2026-3415 The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows.High 8.7 · Aug 6, 2026
• CVE-2025-14561 In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly.Critical 9 · Aug 6, 2026
• CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability Exploited · Critical 10 · Aug 6, 2026
• CVE-2026-1728 Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.Critical 9.8 · Aug 6, 2026
• CVE-2025-15039 The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific mCritical 9.4 · Aug 6, 2026
• CVE-2026-4249 The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and conteHigh 8.6 · Jul 6, 2026
• CVE-2026-2053 The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within thHigh 8.3 · Jun 26, 2026
• CVE-2025-10470 The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled High 8.6 · May 11, 2026
• CVE-2025-10908 Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methodHigh 7.3 · May 11, 2026
• CVE-2024-2374 The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities.High 7.5 · Apr 16, 2026
• CVE-2024-1524 When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's informatiHigh 7.7 · Feb 24, 2026
• CVE-2025-13590 A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API.Critical 9.1 · Feb 19, 2026
• CVE-2025-12107 The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-contHigh 8.4 · Feb 19, 2026
• CVE-2025-9312 A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 prCritical 9.8 · Nov 18, 2025
• CVE-2025-6670 A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within adHigh 8.8 · Nov 18, 2025
• CVE-2025-11093 An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator enginesHigh 8.4 · Nov 5, 2025
• CVE-2025-10907 An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin serviceHigh 8.4 · Nov 5, 2025