WSO2 Open Banking Km vulnerabilities

9 CVEs affecting WSO2 Open Banking Km, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-15039, published 2026-08-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-29464: WSO2 Multiple Products Unrestrictive Upload of File Vulnerability, published 2022-04-18. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-25. EPSS: 100% chance of exploitation in the next 30 days. Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to…
CVE-2025-10611, published 2025-10-16. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without…
CVE-2024-6914, published 2025-05-22. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this…
CVE-2024-7096, published 2025-05-30. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when…
CVE-2025-15039, published 2026-08-06. Critical severity, CVSS 9.4. EPSS: 0.7% chance of exploitation in the next 30 days. The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain…
CVE-2024-7097, published 2025-05-30. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration…
CVE-2025-9804, published 2025-10-16. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged…
CVE-2025-9312, published 2025-11-18. Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days. A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of…
CVE-2024-7073, published 2025-06-02. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate…