Is CVE-2026-2613 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2613 being exploited in the wild.

How severe is CVE-2026-2613?

High severity, with a CVSS score of 8.7, published 2 November 2026.

Which products and versions are affected?

Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0; Wso2 Traffic Manager 4.5.0, 4.6.0; Wso2 Universal Gateway 4.5.0, 4.6.0.

Is there a fix for CVE-2026-2613?

Yes: fixed in API Manager 4.0.0 Update 387, 4.1.0 Update 251, 4.2.0 Update 191, 4.3.0 Update 102, 4.4.0 Update 66, 4.5.0 Update 51, 4.6.0 Update 15; API Control Plane 4.5.0 Update 52, 4.6.0 Update 16; Traffic Manager 4.5.0 Update 50, 4.6.0 Update 15; Universal Gateway 4.5.0 Update 51, 4.6.0 Update 15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2613 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-2613?

Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2613: WSO2 API Manager Admin REST API SQL injection

CVE-2026-2613 · Severity: high · CVSS 8.7 · Published 2026-11-02

WSO2 API Manager is a platform for creating, managing, and publishing APIs. The Admin REST API contains a SQL injection flaw that allows authenticated administrators to manipulate database queries and extract sensitive information or disrupt the database. An attacker with admin credentials can exploit this to access confidential data or cause service outages.

Technologies: Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager, Wso2 Universal Gateway. Vendors: Wso2.

Quick answers

Is CVE-2026-2613 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2613 being exploited in the wild.
How severe is CVE-2026-2613?: High severity, with a CVSS score of 8.7, published 2 November 2026.
Which products and versions are affected?: Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0; Wso2 Traffic Manager 4.5.0, 4.6.0; Wso2 Universal Gateway 4.5.0, 4.6.0.
Is there a fix for CVE-2026-2613?: Yes: fixed in API Manager 4.0.0 Update 387, 4.1.0 Update 251, 4.2.0 Update 191, 4.3.0 Update 102, 4.4.0 Update 66, 4.5.0 Update 51, 4.6.0 Update 15; API Control Plane 4.5.0 Update 52, 4.6.0 Update 16; Traffic Manager 4.5.0 Update 50, 4.6.0 Update 15; Universal Gateway 4.5.0 Update 51, 4.6.0 Update 15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2613 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-2613?: Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: API Manager 4.0.0 Update 387, 4.1.0 Update 251, 4.2.0 Update 191, 4.3.0 Update 102, 4.4.0 Update 66, 4.5.0 Update 51, 4.6.0 Update 15; API Control Plane 4.5.0 Update 52, 4.6.0 Update 16; Traffic Manager 4.5.0 Update 50, 4.6.0 Update 15; Universal Gateway 4.5.0 Update 51, 4.6.0 Update 15

Technical details

The Admin REST API fails to properly sanitize user-supplied input before incorporating it into SQL statement structure, allowing blind SQL injection. The vulnerability requires authentication as an administrator and network access to the API. An authenticated attacker can infer database information and potentially impact database availability.

Affected products

WSO2 API Manager 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
WSO2 API Control Plane 4.5.0, 4.6.0
WSO2 Traffic Manager 4.5.0, 4.6.0
WSO2 Universal Gateway 4.5.0, 4.6.0

Timeline

2026-05-03: disclosed

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.