WSO2 vendor intelligence
WSO2 Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting WSO2 products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 6
- Known exploited vulnerabilities affecting WSO2 products
- In CISA KEV
- 2
- Records also listed in the official catalog
- Beyond CISA KEV
- 4
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 0
- WSO2 KEVs with sensor-observed exploitation activity
The catalog gap matters for WSO2 exposure
Four of the six exploited WSO2 vulnerabilities tracked by Previdian are not in CISA KEV. Teams relying on the official catalog alone would miss two-thirds of this vendor portfolio.
- 33%
- Covered by CISA
- 67%
- Beyond CISA
- 6
- Product families
Attested WSO2 vulnerabilities
6 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-5430
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover |
WSO2 Universal Gateway, WSO2 Traffic Manager, WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon API Manager Rest API Utility | Confirmed | In CISA | 16 Sep 2026 |
|
CVE-2025-5605
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure |
WSO2 Identity Server, WSO2 Enterprise Integrator, WSO2 Universal Gateway, WSO2 Traffic Manager, WSO2 API Manager, WSO2 API Control Plane, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, WSO2 Open Banking IAM, org.wso2.carbon:org.wso2.carbon.ui | High | Beyond CISA | 15 Feb 2026 |
|
CVE-2020-24589
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. |
API Manager | High | Beyond CISA | 25 Jun 2025 |
|
CVE-2024-7097
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup |
WSO2 Open Banking AM, WSO2 Open Banking KM, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Identity Server, WSO2 Open Banking IAM, WSO2 Enterprise Mobility Manager | High | Beyond CISA | 30 May 2025 |
|
CVE-2022-29464
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a... |
WSO2 API Manager, WSO2 Identity Server, WSO2 Identity Server Analytics, WSO2 Enterprise Integrator, WSO2 Open Banking AM, WSO2 Open Banking KM | Confirmed | In CISA | 25 Apr 2022 |
|
CVE-2020-17453
WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. |
WSO2 Management Console | High | Beyond CISA | 05 Apr 2021 |
No WSO2 vulnerabilities match this search or filter.
Showing 6 of 6 on this page (6 WSO2 known exploited vulnerabilities).
Recurring weakness patterns
Limitation, authentication bypass by spoofing, and verification account for three mapped occurrences across this WSO2 KEV portfolio.
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-290
Authentication Bypass by Spoofing
CWE-347
Improper Verification of Cryptographic Signature
CWE-611
Improper Restriction of XML External Entity Reference
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-863
Incorrect Authorization