WSO2 Enterprise Service Bus vulnerabilities

2 CVEs affecting WSO2 Enterprise Service Bus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-9955, published 2025-10-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-9804, published 2025-10-16. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged…
CVE-2025-9955, published 2025-10-16. Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days. An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store…