# Wso2 vulnerabilities Source: https://junglewise.ai/threats/vendors/wso2 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/wso2.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 62 vulnerabilities in Wso2: 0 in the last 7 days and 33 in the last 90 days, 6 of them critical and 2 exploited in the wild. The most recent, CVE-2025-11229, was published on 4 November 2026. 26 vulnerabilities in the last four weeks, up 550% on the four before (4). 2 critical against 0. 9 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 26 - Last 90 days: 33 - All time: 62 (6 critical, 2 exploited in the wild) ## About Wso2 Software company that provides open-source identity and API management platforms. ## Latest Wso2 vulnerabilities - [CVE-2025-11229: WSO2 Identity Server privilege escalation via client credentials grant type](https://junglewise.ai/threats/cve-2025-11229-the-system-fails-to-properly-enforce-scope-authorization-when-the) (high, CVSS 7.2, published 4 Nov 2026) - [CVE-2026-4052: WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is) (critical, CVSS 9.8, published 3 Nov 2026) - [CVE-2025-1397: WSO2 Access token issuance without IDP status validation](https://junglewise.ai/threats/cve-2025-1397-when-utilizing-jwt-bearer-or-saml2-bearer-grant-types-the-system) (medium, CVSS 4.8, published 3 Nov 2026) - [CVE-2024-9517: WSO2 refresh token grant account lockout bypass](https://junglewise.ai/threats/cve-2024-9517-the-refresh-token-grant-type-in-wso2-products-fails-to-re-validate) (medium, CVSS 4.9, published 2 Nov 2026) - [CVE-2026-2613: WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately) (high, CVSS 8.7, published 2 Nov 2026) - [CVE-2025-12544: WSO2 API Manager SVG upload stored XSS in Publisher portal](https://junglewise.ai/threats/cve-2025-12544-the-publisher-portal-fails-to-enforce-proper-validation-on) (medium, CVSS 4.8, published 2 Nov 2026) - [CVE-2026-18800: WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with) (medium, CVSS 4.4, published 2 Nov 2026) - [CVE-2025-13647: WSO2 Identity Server content-type validation bypass](https://junglewise.ai/threats/cve-2025-13647-the-affected-component-fails-to-enforce-expected-validation) (medium, CVSS 5.8, published 2 Nov 2026) - [CVE-2025-11969: WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control) (critical, CVSS 9.4, published 2 Nov 2026) - [CVE-2024-5617: WSO2 account lock bypass in multi-store authentication](https://junglewise.ai/threats/cve-2024-5617-the-account-lock-feature-fails-to-correctly-enforce-account) (medium, CVSS 4.8, published 2 Nov 2026) - [CVE-2026-78674: WSO2 BPMN System REST API command injection in input validation](https://junglewise.ai/threats/cve-2026-78674-the-bpmn-system-rest-apis-do-not-sufficiently-validate-input) (high, CVSS 8.8, published 28 Oct 2026) - [CVE-2026-6647: WSO2 Identity Server OAuth token revocation bypass with mixed-case usernames](https://junglewise.ai/threats/cve-2026-6647-in-deployments-of-wso2-identity-server-configured-with-a-case) (high, CVSS 7.4, published 28 Oct 2026) - [CVE-2026-11854: WSO2 authentication endpoint XSS via reflected error message](https://junglewise.ai/threats/cve-2026-11854-the-authentication-endpoint-generates-an-error-message-that) (medium, CVSS 6.1, published 28 Oct 2026) - [CVE-2025-14260: WSO2 product improper access control in resource location handling](https://junglewise.ai/threats/cve-2025-14260-due-to-the-improper-implementation-of-access-control-rules-the) (high, CVSS 8.3, published 28 Oct 2026) - [CVE-2025-0326: WSO2 API Platform access token invalidation bypass in sub-organization management](https://junglewise.ai/threats/cve-2025-0326-the-system-fails-to-invalidate-existing-access-tokens-associated) (info, published 21 Oct 2026) - [CVE-2024-7478: WSO2 username enumeration in external user store authentication](https://junglewise.ai/threats/cve-2024-7478-when-a-wso2-product-is-configured-to-use-an-external-user-store) (medium, CVSS 5.8, published 21 Oct 2026) - [CVE-2024-5139: WSO2 Carbon Identity Framework reflected XSS in authentication endpoint](https://junglewise.ai/threats/cve-2024-5139-the-authentication-endpoint-accepts-user-supplied-input-without) (medium, CVSS 6.1, published 21 Oct 2026) - [CVE-2024-4989: WSO2 API Manager callback URL validation bypass](https://junglewise.ai/threats/cve-2024-4989-the-callback-url-parameter-in-wso2-api-manager-fails-to-validate) (medium, CVSS 5.4, published 21 Oct 2026) - [CVE-2024-2323: WSO2 RemoteUserStoreManagerService insufficient password change validation](https://junglewise.ai/threats/cve-2024-2323-the-remoteuserstoremanagerservice-does-not-sufficiently-validate) (medium, CVSS 4.8, published 20 Oct 2026) - [CVE-2025-7203: WSO2 Management Console credentials exposure in remote logging](https://junglewise.ai/threats/cve-2025-7203-the-management-console-and-product-files-expose-sensitive-data) (medium, CVSS 4.9, published 19 Oct 2026) - [CVE-2025-7043: WSO2 API Manager refresh token validation bypass](https://junglewise.ai/threats/cve-2025-7043-the-forgerock-client-fails-to-correctly-validate-refresh-tokens) (medium, CVSS 5.4, published 19 Oct 2026) - [CVE-2025-6623: WSO2 Carbon console stored cross-site scripting in XML input](https://junglewise.ai/threats/cve-2025-6623-the-carbon-console-accepts-user-supplied-xml-input-without) (medium, CVSS 4.3, published 19 Oct 2026) - [CVE-2025-13591: WSO2 Identity Server username enumeration in authentication endpoint](https://junglewise.ai/threats/cve-2025-13591-the-authentication-endpoint-of-wso2-identity-server-fails-to) (medium, CVSS 5.3, published 19 Oct 2026) - [CVE-2025-13173: WSO2 products session-bound token improper revocation](https://junglewise.ai/threats/cve-2025-13173-tokens-associated-with-user-sessions-are-not-revoked-when-the) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2025-10149: WSO2 Identity Server authorization bypass in SCIM endpoint](https://junglewise.ai/threats/cve-2025-10149-the-scim-endpoint-does-not-sufficiently-validate-authorization) (high, CVSS 8.2, published 19 Oct 2026) ## Most severe Wso2 vulnerabilities - [CVE-2026-5430: WSO2 API Control Plane path traversal vulnerability](https://junglewise.ai/threats/cve-2026-5430-wso2-api-control-plane-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 10, published 6 Aug 2026) - [CVE-2022-29464: WSO2 Multiple Products Unrestrictive Upload of File Vulnerability](https://junglewise.ai/threats/cve-2022-29464-wso2-multiple-products-unrestrictive-upload-of-file-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Apr 2022) - [CVE-2026-4052: WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is) (critical, CVSS 9.8, published 3 Nov 2026) - [CVE-2025-11969: WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control) (critical, CVSS 9.4, published 2 Nov 2026) - [CVE-2025-13590: WSO2 API Manager arbitrary file upload in system REST API](https://junglewise.ai/threats/cve-2025-13590-wso2-api-manager-arbitrary-file-upload-in-system-rest-api) (critical, CVSS 9.1, published 19 Feb 2026) - [CVE-2025-14561: WSO2 Publisher REST APIs tenant isolation bypass in multi-tenant deployments](https://junglewise.ai/threats/cve-2025-14561-wso2-publisher-rest-apis-tenant-isolation-bypass-in-multi-tenant) (critical, CVSS 9, published 6 Aug 2026) - [CVE-2026-78674: WSO2 BPMN System REST API command injection in input validation](https://junglewise.ai/threats/cve-2026-78674-the-bpmn-system-rest-apis-do-not-sufficiently-validate-input) (high, CVSS 8.8, published 28 Oct 2026) - [CVE-2026-2613: WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately) (high, CVSS 8.7, published 2 Nov 2026) - [CVE-2025-10470: WSO2 Identity Server denial of service in Magic Link authentication](https://junglewise.ai/threats/cve-2025-10470-wso2-identity-server-denial-of-service-in-magic-link) (high, CVSS 8.6, published 11 May 2026) - [CVE-2026-4249: WSO2 Multiple Products persistent DoS in throttling event handling](https://junglewise.ai/threats/cve-2026-4249-wso2-multiple-products-persistent-dos-in-throttling-event-handling) (high, CVSS 8.6, published 6 Jul 2026) ## Vulnerabilities per week 26 vulnerabilities in the last four weeks, up 550% on the four before (4). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 11 | 0 | 0 | | 26 Oct 2026 | 4 | 0 | 0 | | 2 Nov 2026 | 10 | 2 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Wso2 technologies - [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager): 38 vulnerabilities - [Wso2 Identity Server](https://junglewise.ai/threats/technologies/identity-server): 38 vulnerabilities - [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane): 26 vulnerabilities - [Wso2 Traffic Manager](https://junglewise.ai/threats/technologies/traffic-manager): 19 vulnerabilities - [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway): 19 vulnerabilities - [Wso2 Identity Server as Key Manager](https://junglewise.ai/threats/technologies/identity-server-as-key-manager): 15 vulnerabilities - [Wso2 Open Banking IAM](https://junglewise.ai/threats/technologies/open-banking-iam): 15 vulnerabilities - [Wso2 Open Banking AM](https://junglewise.ai/threats/technologies/open-banking-am): 11 vulnerabilities - [Wso2 Enterprise Integrator](https://junglewise.ai/threats/technologies/enterprise-integrator): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wso2 vulnerabilities", https://junglewise.ai/threats/vendors/wso2, 12 November 2026.