Wso2 Carbon vulnerabilities

• wso2 jwt grant type for oauth2, api control plane, api manager +7 more +9 more Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers CVE-2025-1397 4.8 MediumNovember 3, 2026
• wso2 api control plane, api manager, carbon oauth +6 more +8 more Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts CVE-2024-9517 4.9 MediumNovember 2, 2026
• wso2 api manager, carbon registry kernel, enterprise integrator +4 more +6 more Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks CVE-2024-2372 5.4 MediumNovember 2, 2026
• wso2 api manager, carbon api manager publisher rest api +1 more Stored Cross-Site Scripting in Multiple WSO2 Products CVE-2025-12544 4.8 MediumNovember 2, 2026
• wso2 api control plane, api manager, carbon api management implementation +2 more +4 more SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption CVE-2026-2613 8.7 HighNovember 2, 2026
• wso2 api control plane, api manager, carbon event publisher core +6 more +8 more Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data CVE-2026-18800 4.4 MediumNovember 2, 2026
• wso2 api manager, carbon user management ui, enterprise integrator +1 more +3 more Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products CVE-2024-7075 4.6 MediumNovember 2, 2026
• wso2 api manager, carbon identity management, carbon user manager kernel +1 more +3 more Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks CVE-2024-5617 4.8 MediumNovember 2, 2026
• wso2 api manager, api control plane, carbon api manager rest api common functions +6 more +8 more Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions CVE-2025-11969 9.4 CriticalNovember 2, 2026
• wso2 identity server, carbon oauth +1 more Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events CVE-2026-6647 7.4 HighOctober 28, 2026
• wso2 api control plane, api manager, carbon oauth +6 more +8 more Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] CVE-2026-3583 3.1 LowOctober 28, 2026
• wso2 saml2 sso authenticator ui bundle, api manager, carbon ui +4 more +6 more Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources CVE-2025-14260 8.3 HighOctober 28, 2026
• wso2 api manager, carbon identity application, carbon identity core +5 more +7 more Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage CVE-2024-6423 4.0 MediumOctober 21, 2026
• wso2 identity server, carbon oauth +1 more Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access CVE-2025-0326 7.4 HighOctober 21, 2026
• wso2 api manager, carbon user management ui, enterprise integrator +4 more +6 more Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection CVE-2024-5139 6.1 MediumOctober 21, 2026
• wso2 api manager, carbon user manager kernel, enterprise integrator +4 more +6 more Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery CVE-2024-2323 4.8 MediumOctober 20, 2026
• wso2 api manager, carbon identity application authentication framework, carbon identity recovery management +8 more +10 more Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations CVE-2024-4412 2.7 LowOctober 19, 2026
• wso2 api control plane, api manager, carbon oauth +6 more +8 more Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination CVE-2025-13173 6.5 MediumOctober 19, 2026
• wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 more Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery CVE-2025-13591 5.3 MediumOctober 19, 2026
• wso2 carbon scim 2.0 common component, carbon scim common component, identity server +2 more +4 more Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover CVE-2025-10149 8.2 HighOctober 19, 2026
• wso2 api control plane, api manager, carbon identity api server configs v1 +5 more +7 more Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials CVE-2025-7203 4.9 MediumOctober 19, 2026
• wso2 api control plane, api manager, carbon event publisher ui +3 more +5 more Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection CVE-2025-6623 4.3 MediumOctober 19, 2026
• wso2 api manager, carbon user manager kernel, enterprise integrator +4 more +6 more Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution CVE-2024-4457 9.1 CriticalOctober 18, 2026
• wso2 api control plane, api manager, carbon identity application authentication framework +7 more +9 more Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery CVE-2025-5802 5.3 MediumSeptember 15, 2026
• wso2 api control plane, api manager, api manager publisher rest api v4 +4 more +6 more Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution CVE-2026-3418 9.1 CriticalAugust 6, 2026
• wso2 api control plane, api manager, carbon api gateway +3 more +5 more XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service CVE-2026-3415 8.7 HighAugust 6, 2026
• wso2 api control plane, api manager, carbon api management implementation +3 more +5 more Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations CVE-2025-14561 9.0 CriticalAugust 6, 2026
• wso2 api control plane, api manager, multiple products +3 more +5 more Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover CVE-2026-5430 In KEVPublic exploit EPSS 22.4% 10.0 CriticalAugust 6, 2026
• wso2 api control plane, api manager, traffic manager +3 more +5 more Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover CVE-2026-1728 9.8 CriticalAugust 6, 2026
• wso2 api control plane, api manager, identity server +7 more +9 more Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVE-2025-15039 9.4 CriticalAugust 6, 2026
• wso2 api control plane, api manager, enterprise integrator +44 more +46 more Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions CVE-2025-13394 5.4 MediumAugust 6, 2026
• wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 more +4 more Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure CVE-2025-13909 4.3 MediumAugust 6, 2026
• wso2 identity server, carbon oauth +1 more Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions CVE-2025-12627 2.4 LowAugust 6, 2026
• wso2 identity server, carbon identity api server secret management common, carbon identity api server secret management v1 +2 more Improper Access Control via Secret Type Management API in WSO2 Identity Server CVE-2025-14779 3.8 LowAugust 6, 2026
• wso2 api control plane, api manager, identity server +5 more +7 more Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure CVE-2024-10302 4.0 MediumAugust 6, 2026
• wso2 api control plane, api manager, identity server +7 more +9 more Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks CVE-2024-6832 5.9 MediumAugust 6, 2026
• wso2 api control plane, api manager, identity server +6 more +8 more Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access CVE-2024-8995 4.9 MediumAugust 6, 2026
• wso2 identity server, carbon magiclink authenticator module +1 more Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability CVE-2025-10470 8.6 HighMay 11, 2026
• wso2 api control plane, api manager, traffic manager +3 more +5 more Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations CVE-2025-8325 6.3 MediumMay 11, 2026
• wso2 api control plane, api manager, traffic manager +3 more +5 more HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation CVE-2025-8154 5.3 MediumMay 11, 2026
• wso2 identity server, carbon magiclink authenticator module +1 more Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access CVE-2025-10908 7.3 HighMay 11, 2026
• wso2 email otp authenticator, identity server, identity server as key manager +2 more +4 more Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery CVE-2024-0391 5.3 MediumMay 11, 2026
• wso2 api control plane, api manager, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl +2 more +4 more Authenticated arbitrary file upload via a System REST API requiring administrator permission. CVE-2025-13590 Fix available 9.1 CriticalFebruary 19, 2026
• wso2 api manager, api control plane, identity server +7 more +9 more Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVE-2025-9312 9.8 CriticalNovember 18, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services CVE-2025-6670 8.8 HighNovember 18, 2025
• wso2 api control plane, api manager, enterprise integrator +10 more +12 more Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding CVE-2025-10853 5.2 MediumNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +15 more +17 more Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution CVE-2025-10907 8.4 HighNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration CVE-2025-10713 Fix available 6.5 MediumNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +6 more +8 more Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution CVE-2025-3125 6.7 MediumNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure CVE-2025-5605 4.3 MediumOctober 24, 2025
• Show olderLoading…