Is CVE-2026-4103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4103 being exploited in the wild.

How severe is CVE-2026-4103?

Medium severity, with a CVSS score of 6.4, published 14 September 2026.

Which products and versions are affected?

Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0.

Is there a fix for CVE-2026-4103?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-4103 attacked?

It is attacked over the network.

Am I affected by CVE-2026-4103?

Check whether you run Wso2 API Control Plane or Wso2 API Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4103: WSO2 API Manager stored XSS in Publisher Portal and Developer Portal

CVE-2026-4103 · Severity: medium · CVSS 6.4 · Published 2026-09-14

WSO2 API Manager's Publisher Portal and Developer Portal allow API documentation to be created and viewed. A vulnerability in HTML sanitization permits attackers with portal access to inject malicious JavaScript code into API documents, which executes in users' browsers when those documents are viewed. This could allow attackers to steal session tokens, modify API configurations, or perform other actions on behalf of authenticated users.

Technologies: Wso2 API Control Plane, Wso2 API Manager. Vendors: Wso2.

Quick answers

Is CVE-2026-4103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4103 being exploited in the wild.
How severe is CVE-2026-4103?: Medium severity, with a CVSS score of 6.4, published 14 September 2026.
Which products and versions are affected?: Wso2 API Control Plane 4.5.0, 4.6.0; Wso2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0.
Is there a fix for CVE-2026-4103?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-4103 attacked?: It is attacked over the network.
Am I affected by CVE-2026-4103?: Check whether you run Wso2 API Control Plane or Wso2 API Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability caused by insufficient HTML sanitization in the Publisher Portal and Developer Portal components. Untrusted user input is rendered without proper encoding or neutralization, allowing attackers to inject and execute arbitrary JavaScript. The vulnerability requires authentication (login to the portal) and affects API documentation viewing. Successful exploitation enables session hijacking, credential theft, or unauthorized actions within the attacker's privilege level. Patches are available as updates to affected versions (WSO2 API Manager 3.2.0–4.6.0 and WSO2 API Control Plane 4.5.0–4.6.0), requiring configuration of a new 'sanitizeHtmlDocs' setting to enable HTML sanitization.

Affected products

WSO2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.6.0
WSO2 API Control Plane 4.5.0, 4.6.0

Timeline

2026-07-04: disclosed
2026-07-04: advisory: WSO2-2026-4844

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-4844/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.