Quick answers
- Is CVE-2026-3096 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-3096 being exploited in the wild.
- How severe is CVE-2026-3096?
- Medium severity, with a CVSS score of 4.7, published 10 September 2026.
- Which products and versions are affected?
- Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0.
- Is there a fix for CVE-2026-3096?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-3096 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-3096?
- Check whether you run Wso2 API Control Plane or Wso2 API Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a reverse tabnabbing attack in the product's web portal link-handling functionality. When external links are opened in new tabs, the originating window object remains accessible to the newly-opened page via the window.opener property (or similar mechanisms), allowing the attacker-controlled page to manipulate or redirect the original trusted application window. The attack requires user interaction (clicking a malicious link) and affects the web portal UI layer. Patches are available via GitHub and through WSO2 support subscription updates at specified update levels for affected versions.
Affected products
- WSO2 API Control Plane 4.5.0, 4.6.0
- WSO2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
Timeline
- 2026-07-04: disclosed
- 2026-09-10: advisory