#wso2
3 articles
Security Alerts Nov 3, 2026
CVE-2026-4052: Access Control Flaw in WSO2 API Manager / Identity Server
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System...
Security Alerts Sep 24, 2026
CVE-2026-5430: Critical Flaw in WSO2 API Manager and API Gateways
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. ...
Security Alerts Jul 9, 2025
CVE-2025-13590: Remote code execution in Wso2 Api Control Plane
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code exec...