Product by WSO2
Wso2 API Manager
83 known vulnerabilities in Wso2 API Manager (WSO2), 1 of them actively exploited (CISA KEV).
Key figures
83
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
16
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-5430 | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover In CISA KEValso in 8 other products | 10.0 | |
| Medium | CVE-2024-7074 | WSO2 Enterprise Integrator: Unrestricted Upload of File with Dangerous Type | 6.8 | |
| Critical | CVE-2025-2905 | An XML External Entity (XXE) vulnerability in Multiple WSO2 Products | 9.1 | |
| Critical | CVE-2026-3418 | Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution | 9.1 | |
| Critical | CVE-2025-15039 | Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products | 9.4 | |
| Critical | CVE-2025-10611 | Potential Broken Access Control in Multiple WSO2 Products via System REST APIs | 9.8 | |
| Critical | CVE-2024-4457 | WSO2 Enterprise Integrator: OS Command Injection | 9.1 | |
| Critical | CVE-2026-1728 | Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover | 9.8 | |
| Critical | CVE-2025-13590 | WSO2 API Manager: Unrestricted File Upload | 9.1 | |
| Critical | CVE-2025-9152 | Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint | 9.8 | |
| Critical | CVE-2024-6914 | WSO2 API Manager: Incorrect Authorization | 9.8 | |
| High | CVE-2026-4249 | WSO2 Universal Gateway: Improper Neutralization | 8.6 | |
| High | CVE-2026-3415 | WSO2 API Manager: XML Entity Expansion | 8.7 | |
| Critical | CVE-2026-2053 | Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager | 10.0 | |
| Critical | CVE-2025-14561 | WSO2 API Manager: Improper Access Control | 9.0 | |
| Critical | CVE-2025-9804 | WSO2 API Manager: Improper Access Control | 9.6 | |
| High | CVE-2025-12737 | WSO2 Open Banking AM: OS Command Injection | 8.4 | |
| High | CVE-2025-3125 | WSO2 Identity Server: Unrestricted Upload of File with Dangerous Type | 6.7 | |
| High | CVE-2025-10907 | WSO2 API Manager: Unrestricted Upload of File with Dangerous Type | 8.4 | |
| High | CVE-2025-14260 | WSO2 API Manager: Server-Side Request Forgery (SSRF) | 8.3 | |
| High | CVE-2024-6832 | WSO2 Enterprise Integrator: Protection Mechanism Failure | 7.5 | |
| High | CVE-2025-5717 | Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service | 6.8 | |
| High | CVE-2025-11093 | WSO2 Micro Integrator: Code Injection | 8.4 | |
| Medium | CVE-2026-4103 | WSO2 API Control Plane: Cross-site Scripting | 6.4 | |
| Critical | CVE-2025-9312 | Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products | 9.8 |
News
- CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacksbleepingcomputer,
- WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEVthehackernews,
- Enterprises Warned of Attacks Exploiting WSO2 Vulnerabilitysecurityweek,
- Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokensthehackernews,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31sans-atrisk-mail,