# Wso2 Traffic Manager vulnerabilities Source: https://junglewise.ai/threats/technologies/traffic-manager Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/traffic-manager.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in Wso2 Traffic Manager: 0 in the last 7 days and 8 in the last 90 days, 4 of them critical and 1 exploited in the wild. The most recent, CVE-2026-2613, was published on 2 November 2026. 6 vulnerabilities in the last four weeks, up 500% on the four before (1). 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 8 - All time: 19 (4 critical, 1 exploited in the wild) ## About Wso2 Traffic Manager API Gateway component for managing and routing API traffic. ## Latest Wso2 Traffic Manager vulnerabilities - [CVE-2026-2613: WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately) (high, CVSS 8.7, published 2 Nov 2026) - [CVE-2026-18800: WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with) (medium, CVSS 4.4, published 2 Nov 2026) - [CVE-2025-11969: WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control) (critical, CVSS 9.4, published 2 Nov 2026) - [CVE-2025-7203: WSO2 Management Console credentials exposure in remote logging](https://junglewise.ai/threats/cve-2025-7203-the-management-console-and-product-files-expose-sensitive-data) (medium, CVSS 4.9, published 19 Oct 2026) - [CVE-2025-6623: WSO2 Carbon console stored cross-site scripting in XML input](https://junglewise.ai/threats/cve-2025-6623-the-carbon-console-accepts-user-supplied-xml-input-without) (medium, CVSS 4.3, published 19 Oct 2026) - [CVE-2025-13173: WSO2 products session-bound token improper revocation](https://junglewise.ai/threats/cve-2025-13173-tokens-associated-with-user-sessions-are-not-revoked-when-the) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2025-5802: WSO2 Identity Server username enumeration in self-registration](https://junglewise.ai/threats/cve-2025-5802-wso2-identity-server-username-enumeration-in-self-registration) (medium, CVSS 5.3, published 15 Sep 2026) - [CVE-2025-12737: WSO2 Carbon Console remote code execution in administrative operations](https://junglewise.ai/threats/cve-2025-12737-wso2-carbon-console-remote-code-execution-in-administrative) (high, CVSS 8.4, published 3 Sep 2026) - [CVE-2025-14561: WSO2 Publisher REST APIs tenant isolation bypass in multi-tenant deployments](https://junglewise.ai/threats/cve-2025-14561-wso2-publisher-rest-apis-tenant-isolation-bypass-in-multi-tenant) (critical, CVSS 9, published 6 Aug 2026) - [CVE-2026-5430: WSO2 API Control Plane path traversal vulnerability](https://junglewise.ai/threats/cve-2026-5430-wso2-api-control-plane-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 10, published 6 Aug 2026) - [CVE-2026-0637: When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded…](https://junglewise.ai/threats/cve-2026-0637-when-a-proxy-server-is-configured-with-customurl-enabled-the) (medium, CVSS 5.4, published 6 Aug 2026) - [CVE-2024-8995: Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This…](https://junglewise.ai/threats/cve-2024-8995-unused-authorization-codes-issued-to-deleted-users-are-not-being) (medium, CVSS 4.9, published 6 Aug 2026) - [CVE-2024-6832: The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not…](https://junglewise.ai/threats/cve-2024-6832-the-account-locking-mechanism-fails-to-trigger-when-secondary-user) (medium, CVSS 5.9, published 6 Aug 2026) - [CVE-2024-10302: The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness…](https://junglewise.ai/threats/cve-2024-10302-the-user-self-signup-flow-in-multiple-wso2-products-fails-to) (medium, CVSS 4, published 6 Aug 2026) - [CVE-2026-4249: WSO2 Multiple Products persistent DoS in throttling event handling](https://junglewise.ai/threats/cve-2026-4249-wso2-multiple-products-persistent-dos-in-throttling-event-handling) (high, CVSS 8.6, published 6 Jul 2026) - [CVE-2025-8591: WSO2 multiple products reflected XSS via URL parameter](https://junglewise.ai/threats/cve-2025-8591-wso2-multiple-products-reflected-xss-via-url-parameter) (medium, CVSS 6.1, published 6 Jul 2026) - [CVE-2025-8325: WSO2 API Manager RBAC bypass in Gateway API](https://junglewise.ai/threats/cve-2025-8325-wso2-api-manager-rbac-bypass-in-gateway-api) (medium, CVSS 6.3, published 11 May 2026) - [CVE-2025-8154: WSO2 API Manager header injection in Webhook API](https://junglewise.ai/threats/cve-2025-8154-wso2-api-manager-header-injection-in-webhook-api) (medium, CVSS 5.3, published 11 May 2026) - [CVE-2025-13590: WSO2 API Manager arbitrary file upload in system REST API](https://junglewise.ai/threats/cve-2025-13590-wso2-api-manager-arbitrary-file-upload-in-system-rest-api) (critical, CVSS 9.1, published 19 Feb 2026) ## Most severe Wso2 Traffic Manager vulnerabilities - [CVE-2026-5430: WSO2 API Control Plane path traversal vulnerability](https://junglewise.ai/threats/cve-2026-5430-wso2-api-control-plane-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 10, published 6 Aug 2026) - [CVE-2025-11969: WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control) (critical, CVSS 9.4, published 2 Nov 2026) - [CVE-2025-13590: WSO2 API Manager arbitrary file upload in system REST API](https://junglewise.ai/threats/cve-2025-13590-wso2-api-manager-arbitrary-file-upload-in-system-rest-api) (critical, CVSS 9.1, published 19 Feb 2026) - [CVE-2025-14561: WSO2 Publisher REST APIs tenant isolation bypass in multi-tenant deployments](https://junglewise.ai/threats/cve-2025-14561-wso2-publisher-rest-apis-tenant-isolation-bypass-in-multi-tenant) (critical, CVSS 9, published 6 Aug 2026) - [CVE-2026-2613: WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately) (high, CVSS 8.7, published 2 Nov 2026) - [CVE-2026-4249: WSO2 Multiple Products persistent DoS in throttling event handling](https://junglewise.ai/threats/cve-2026-4249-wso2-multiple-products-persistent-dos-in-throttling-event-handling) (high, CVSS 8.6, published 6 Jul 2026) - [CVE-2025-12737: WSO2 Carbon Console remote code execution in administrative operations](https://junglewise.ai/threats/cve-2025-12737-wso2-carbon-console-remote-code-execution-in-administrative) (high, CVSS 8.4, published 3 Sep 2026) - [CVE-2025-13173: WSO2 products session-bound token improper revocation](https://junglewise.ai/threats/cve-2025-13173-tokens-associated-with-user-sessions-are-not-revoked-when-the) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2025-8325: WSO2 API Manager RBAC bypass in Gateway API](https://junglewise.ai/threats/cve-2025-8325-wso2-api-manager-rbac-bypass-in-gateway-api) (medium, CVSS 6.3, published 11 May 2026) - [CVE-2025-8591: WSO2 multiple products reflected XSS via URL parameter](https://junglewise.ai/threats/cve-2025-8591-wso2-multiple-products-reflected-xss-via-url-parameter) (medium, CVSS 6.1, published 6 Jul 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up 500% on the four before (1). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 3 | 1 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Wso2 technologies - [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager): 38 vulnerabilities - [Wso2 Identity Server](https://junglewise.ai/threats/technologies/identity-server): 38 vulnerabilities - [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane): 26 vulnerabilities - [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway): 19 vulnerabilities - [Wso2 Identity Server as Key Manager](https://junglewise.ai/threats/technologies/identity-server-as-key-manager): 15 vulnerabilities - [Wso2 Open Banking IAM](https://junglewise.ai/threats/technologies/open-banking-iam): 15 vulnerabilities - [Wso2 Open Banking AM](https://junglewise.ai/threats/technologies/open-banking-am): 11 vulnerabilities - [Wso2 Enterprise Integrator](https://junglewise.ai/threats/technologies/enterprise-integrator): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wso2 Traffic Manager vulnerabilities", https://junglewise.ai/threats/technologies/traffic-manager, 10 November 2026.