Product by WSO2

WSO2 API Manager

95 known vulnerabilities in WSO2 API Manager (WSO2), 2 of them actively exploited (CISA KEV).

Vulnerabilities

Actively exploited (KEV)

Used by ransomware

Critical

Vulnerabilities

Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

Vulnerabilities in WSO2 API Manager (WSO2)

Critical	CVE-2022-29464	WSO2 Multiple Products Unrestrictive Upload of File Vulnerability In CISA KEVRansomwarealso in 7 other products	9.8	18.04.2022
Critical	CVE-2026-5430	Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover In CISA KEValso in 8 other products	10.0	06.08.2026
Critical	CVE-2020-24589	WSO2 API Manager: XML External Entity (XXE) also in 1 other product	9.1	21.08.2020
Critical	CVE-2021-42646	WSO2 API Manager: XML External Entity (XXE) also in 2 other products	9.1	11.05.2022
Medium	CVE-2020-17453	WSO2 Identity Server as Key Manager: Cross-Site Scripting (XSS) also in 7 other products	6.1	05.04.2021
Critical	CVE-2020-13226	WSO2 API Manager: Server-Side Request Forgery (SSRF)	9.8	20.05.2020
Medium	CVE-2022-29548	WSO2 API Manager: Cross-Site Scripting (XSS) also in 8 other products	4.6	21.04.2022
Critical	CVE-2025-2905	An XML External Entity (XXE) vulnerability in Multiple WSO2 Products also in 5 other products	9.1	05.05.2025
Critical	CVE-2025-15039	Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products also in 18 other products	9.4	06.08.2026
Medium	CVE-2017-14651	WSO2 Data Analytics Server: Cross-Site Scripting (XSS) also in 6 other products	4.8	21.09.2017
Critical	CVE-2025-10611	Potential Broken Access Control in Multiple WSO2 Products via System REST APIs also in 17 other products	9.8	16.10.2025
Critical	CVE-2026-1728	Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover also in 8 other products	9.8	06.08.2026
Critical	CVE-2025-13590	WSO2 API Manager: Unrestricted File Upload also in 7 other products	9.1	19.02.2026
Critical	CVE-2020-24590	WSO2 API Manager: security vulnerability also in 1 other product	9.1	21.08.2020
Critical	CVE-2025-9152	Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint also in 3 other products	9.8	16.10.2025
Critical	CVE-2024-6914	WSO2 API Manager: Incorrect Authorization also in 11 other products	9.8	22.05.2025
High	CVE-2026-4249	WSO2 Universal Gateway: Improper Neutralization also in 7 other products	8.6	06.07.2026
Critical	CVE-2026-2053	Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager also in 1 other product	10.0	26.06.2026
High	CVE-2020-24705	WSO2 API Manager: security vulnerability also in 5 other products	8.8	27.08.2020
High	CVE-2020-24703	WSO2 Identity Server: security vulnerability also in 8 other products	8.8	27.08.2020
Critical	CVE-2025-9804	WSO2 API Manager: Improper Access Control also in 24 other products	9.6	16.10.2025
High	CVE-2020-12719	WSO2 API Manager: XML External Entity (XXE) also in 6 other products	8.7	07.05.2020
High	CVE-2025-12737	WSO2 Open Banking AM: OS Command Injection also in 15 other products	8.4	03.09.2026
High	CVE-2025-3125	WSO2 Identity Server: Unrestricted Upload of File with Dangerous Type also in 15 other products	6.7	05.11.2025
High	CVE-2025-10907	WSO2 API Manager: Unrestricted Upload of File with Dangerous Type also in 19 other products	8.4	05.11.2025

All vulnerabilities in search

News

CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacksbleepingcomputer, 25.09.2026
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEVthehackernews, 25.09.2026
Enterprises Warned of Attacks Exploiting WSO2 Vulnerabilitysecurityweek, 16.09.2026
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokensthehackernews, 16.09.2026
@RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31sans-atrisk-mail, 13.08.2026

All products by WSO2

Key figures

Vulnerabilities

News