Is CVE-2024-7075 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-7075 being exploited in the wild.

How severe is CVE-2024-7075?

Medium severity, with a CVSS score of 4.6, published 2 November 2026.

Is there a fix for CVE-2024-7075?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-7075 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2024-7075?

Check whether you run . Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-7075: Management console user search XSS via input encoding failure

CVE-2024-7075 · Severity: medium · CVSS 4.6 · Published 2026-11-02

A management console's user search function fails to properly encode user input before displaying results in the browser, allowing attackers to inject malicious scripts. An attacker can exploit this to redirect users to malicious sites, deface the web interface, or steal sensitive information displayed in the console. The vulnerability is mitigated by the use of httpOnly flags on session cookies, which prevents session hijacking.

Technologies: <UNKNOWN>.

Quick answers

Is CVE-2024-7075 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-7075 being exploited in the wild.
How severe is CVE-2024-7075?: Medium severity, with a CVSS score of 4.6, published 2 November 2026.
Which products and versions are affected?: <UNKNOWN>.
Is there a fix for CVE-2024-7075?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-7075 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2024-7075?: Check whether you run <UNKNOWN>. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a reflected cross-site scripting (XSS) vulnerability in the user search function of a management console where user-supplied input is rendered without proper HTML encoding. An authenticated or unauthenticated attacker can craft a malicious search query that executes JavaScript in the victim's browser within the console's security context, allowing data theft or UI manipulation. httpOnly session cookies provide partial mitigation against session token theft, though other attack vectors remain viable.

Affected products

<UNKNOWN>

Timeline

2026-11-02: disclosed

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3569/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.