CVE-2019-15631: Mulesoft API Gateway

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrary code.

Affected products

• Mulesoft API Gateway: from 2.0.0, up to and including 2.2.12
• Mulesoft Mule Runtime: from 3.0.0, up to and including 3.9.3

Published 2019-12-02. Last modified 2026-06-17.