WSO2 Enterprise Mobility Manager vulnerabilities

2 CVEs affecting WSO2 Enterprise Mobility Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-9804, published 2025-10-16.

More from WSO2.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-14651, published 2017-09-21. Medium severity, CVSS 4.8. EPSS: 3.8% chance of exploitation in the next 30 days. WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
• CVE-2025-9804, published 2025-10-16. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged…