Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-5430 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-24 |
| Vendor | WSO2 |
| Product | API Manager, API Control Plane, Traffic Manager, Universal Gateway |
| CVSS Score | 10.0 (critical) |
| EPSS Score | 0.6% (percentile: 46%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-27 |
Vulnerability Description
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
The NVD entry and vendor advisory WSO2-2026-5328 describe the same CVE differently: the JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured (CWE-347). An attacker can craft a token with an unsupported algorithm that is then incorrectly validated, leading to unauthorized access — including administrative account takeover. For single-tenant deployments the vendor adjusts the score to CVSS 9.8. Whichever description applies, the outcome is the same: unauthenticated takeover of the API platform.
Required Actions
Apply mitigations in accordance with vendor instructions (advisory WSO2-2026-5328), ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Minimum fixed update levels (per NVD data):
- API Manager — 4.1.0.257, 4.2.0.197, 4.3.0.108, 4.4.0.72, 4.5.0.57, 4.6.0.21,
- API Control Plane — 4.5.0.58, 4.6.0.22,
- Traffic Manager — 4.5.0.56, 4.6.0.21,
- Universal Gateway — 4.5.0.57, 4.6.0.21.
After patching, review administrator accounts, application keys and tokens, and API gateway logs for unauthorized changes.
Who Is Affected?
This vulnerability affects the WSO2 API management platform: API Manager, API Control Plane, Traffic Manager and Universal Gateway. These components typically serve API traffic exposed to partners or the internet, and in banks and telecom operators they often act as the central integration gateway — check every instance, including test environments.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
