SecAlerts
w

wso2

Security Risk Profile

46
/100
medium

Security Risk Score

Comprehensive risk assessment based on 150 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from February 16, 2017 to present

150
Total CVEs
47
Critical+High
1
Exploited
18
Unpatched

Threat Assessment

Avg CVSS
6.5
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
18
Critical/High
Risk Level
46/100
medium
⚠️ 1 Active Exploits📈 18 in Last 30 Days

Severity Distribution

Critical
21
High
26
Medium
93
Low
4

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
11

Age Distribution

Common Weaknesses (CWE)

1
XSS
56
2
XEE
12
3
Input Validation
9
4
SSRF
8
5
Malicious File Upload
7

Most Affected Products

1. WSO2 API Manager452
2. WSO2 Identity Server339
3. WSO2 Identity Server as Key Manager114
4. WSO2 Enterprise Integrator55
5. WSO2 Api Control Plane41

Recent Vulnerabilities

See more →
CVE-2026-3418
CVSS 9.1critical

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

Aug 6, 2026🔧 No Patch
CVE-2026-3415
CVSS 8.7high

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

Aug 6, 2026🔧 No Patch
CVE-2025-14561
CVSS 9.0critical

Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

Aug 6, 2026🔧 No Patch
CVE-2025-12317
CVSS 5.0medium

Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges

Aug 6, 2026🔧 No Patch
CVE-2025-6508
CVSS 4.3medium

User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests

Aug 6, 2026🔧 No Patch
CVE-2026-5430
CVSS 10.0critical

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

Aug 6, 2026🔧 No Patch
CVE-2026-1728
CVSS 9.8critical

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

Aug 6, 2026🔧 No Patch
CVE-2025-15039
CVSS 9.4critical

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

Aug 6, 2026🔧 No Patch
CVE-2026-0637
CVSS 4.4medium

Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products

Aug 6, 2026🔧 No Patch
CVE-2025-13394
CVSS 5.4medium

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

Aug 6, 2026🔧 No Patch

Monitor wso2 in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.