WSO2 API Manager vulnerabilities

9 CVEs affecting WSO2 API Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-5802, published 2026-09-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-7074, published 2025-06-02. Medium severity, CVSS 6.8. EPSS: 17.2% chance of exploitation in the next 30 days. An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an…
CVE-2026-3418, published 2026-08-06. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations.…
CVE-2026-3415, published 2026-08-06. High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days. The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of…
CVE-2025-14561, published 2026-08-06. Critical severity, CVSS 9.0. EPSS: 0.4% chance of exploitation in the next 30 days. In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform…
CVE-2024-6541, published 2026-08-06. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify…
CVE-2026-4103, published 2026-09-14. Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and…
CVE-2026-3096, published 2026-09-10. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction…
CVE-2025-6508, published 2026-08-06. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher…
CVE-2025-5802, published 2026-09-15. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username,…