Is CVE-2026-4052 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4052 being exploited in the wild.

How severe is CVE-2026-4052?

Critical severity, with a CVSS score of 9.8, published 3 November 2026.

Which products and versions are affected?

Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0; Wso2 Identity Server all versions (fixed via U2 update and IS Connector).

How is CVE-2026-4052 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-4052?

Check whether you run Wso2 API Control Plane, Wso2 API Manager or Wso2 Identity Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4052: WSO2 Identity Server privilege escalation via shared database

CVE-2026-4052 · Severity: critical · CVSS 9.8 · Published 2026-11-03

WSO2 Identity Server and API Manager, which manage authentication and API access for organizations, can be exploited when configured to share a database. A user who self-registers for an account can obtain administrative tokens and take over the entire system, gaining unrestricted access to all API management functions and sensitive data.

Technologies: Wso2 API Control Plane, Wso2 API Manager, Wso2 Identity Server. Vendors: Wso2.

Quick answers

Is CVE-2026-4052 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4052 being exploited in the wild.
How severe is CVE-2026-4052?: Critical severity, with a CVSS score of 9.8, published 3 November 2026.
Which products and versions are affected?: Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0; Wso2 Identity Server all versions (fixed via U2 update and IS Connector).
Is there a fix for CVE-2026-4052?: Yes: fixed in WSO2 Identity Server latest U2 version; WSO2 API Manager latest U2 version; WSO2 IS Connector (version-specific; see advisory for download links). Until then: Update WSO2 Identity Server to the latest U2 version and WSO2 API Manager to the latest U2 version. Replace the wso2is.key.manager.core and wso2is.notification.event.handlers JAR files with updated versions from the latest IS Connector, and replace the keymanager-operations.war with the updated version from the connector's webapps directory. Restart WSO2 Identity Server deployments after applying these changes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4052 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-4052?: Check whether you run Wso2 API Control Plane, Wso2 API Manager or Wso2 Identity Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: WSO2 Identity Server latest U2 version; WSO2 API Manager latest U2 version; WSO2 IS Connector (version-specific; see advisory for download links)

Update WSO2 Identity Server to the latest U2 version and WSO2 API Manager to the latest U2 version. Replace the wso2is.key.manager.core and wso2is.notification.event.handlers JAR files with updated versions from the latest IS Connector, and replace the keymanager-operations.war with the updated version from the connector's webapps directory. Restart WSO2 Identity Server deployments after applying these changes.

Technical details

A self-registered user can escalate privileges to administrator-level access when WSO2 Identity Server acts as a Resident Key Manager with database sharing enabled. The vulnerability exists in the token endpoint and System REST APIs of WSO2 API Manager versions 4.1.0–4.6.0. An unauthenticated remote attacker can exploit this to invoke privileged API Manager operations without prior authentication.

Affected products

WSO2 Identity Server all versions (fixed via U2 update and IS Connector)
WSO2 API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
WSO2 API Control Plane 4.5.0, 4.6.0

Timeline

2026-06-18: disclosed
2026-06-18: advisory

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.