Wso2 Universal Gateway vulnerabilities

• wso2 api control plane, api manager, identity server +5 more +7 more Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution CVE-2025-12737 8.4 HighSeptember 3, 2026
• wso2 api control plane, api manager, multiple products +3 more +5 more Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover CVE-2026-5430 In KEVPublic exploit EPSS 22.4% 10.0 CriticalAugust 6, 2026
• wso2 api control plane, api manager, traffic manager +3 more +5 more Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover CVE-2026-1728 9.8 CriticalAugust 6, 2026
• wso2 api control plane, api manager, identity server +7 more +9 more Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVE-2025-15039 9.4 CriticalAugust 6, 2026
• wso2 api control plane, api manager, identity server +5 more +7 more Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery CVE-2026-0637 5.4 MediumAugust 6, 2026
• wso2 api control plane, api manager, enterprise integrator +44 more +46 more Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions CVE-2025-13394 5.4 MediumAugust 6, 2026
• wso2 api control plane, api manager, identity server +5 more +7 more Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure CVE-2024-10302 4.0 MediumAugust 6, 2026
• wso2 api control plane, api manager, identity server +7 more +9 more Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks CVE-2024-6832 5.9 MediumAugust 6, 2026
• wso2 api control plane, api manager, identity server +6 more +8 more Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access CVE-2024-8995 4.9 MediumAugust 6, 2026
• wso2 api control plane, api manager, traffic manager +1 more +3 more Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption CVE-2026-4249 8.6 HighJuly 6, 2026
• wso2 api control plane, api manager, identity server +5 more +7 more Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification CVE-2025-8591 6.1 MediumJuly 6, 2026
• wso2 api control plane, api manager, traffic manager +3 more +5 more Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations CVE-2025-8325 6.3 MediumMay 11, 2026
• wso2 api control plane, api manager, traffic manager +3 more +5 more HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation CVE-2025-8154 5.3 MediumMay 11, 2026
• wso2 api control plane, api manager, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl +2 more +4 more Authenticated arbitrary file upload via a System REST API requiring administrator permission. CVE-2025-13590 Fix available 9.1 CriticalFebruary 19, 2026
• wso2 api manager, api control plane, identity server +7 more +9 more Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVE-2025-9312 9.8 CriticalNovember 18, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services CVE-2025-6670 8.8 HighNovember 18, 2025
• wso2 api control plane, api manager, enterprise integrator +10 more +12 more Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding CVE-2025-10853 5.2 MediumNovember 5, 2025
• wso2 api manager, enterprise integrator, micro integrator +8 more +10 more Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) CVE-2025-11093 8.4 HighNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +15 more +17 more Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution CVE-2025-10907 8.4 HighNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration CVE-2025-10713 Fix available 6.5 MediumNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +6 more +8 more Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution CVE-2025-3125 6.7 MediumNovember 5, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure CVE-2025-5605 4.3 MediumOctober 24, 2025
• wso2 api control plane, api manager, enterprise integrator +7 more +9 more SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products CVE-2025-5350 5.9 MediumOctober 24, 2025
• wso2 api manager, api manager analytics, api control plane +19 more +21 more Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs CVE-2025-9804 9.6 CriticalOctober 16, 2025
• wso2 api control plane, api manager, identity server +8 more +10 more Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVE-2025-10611 9.8 CriticalOctober 16, 2025
• wso2 api control plane, api manager, traffic manager +2 more +4 more Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher CVE-2025-4760 Fix available 4.8 MediumSeptember 23, 2025