What’s Vulnerable › Products

WSO2 Universal Gateway vulnerabilities

26 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your WSO2 Universal Gateway version is affected

Exploited WSO2 Universal Gateway vulnerabilities

• CVE-2026-5430 — WSO2 Multiple Products Path Traversal Vulnerability

Latest WSO2 Universal Gateway vulnerabilities

• CVE-2026-3583 — Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] (CVSS 3.1)
• CVE-2025-7043 — Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption (CVSS 5.4)
• CVE-2025-12737 — Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution (CVSS 8.4)
• CVE-2026-3415 — XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service (CVSS 8.7)
• CVE-2026-5430 — WSO2 Multiple Products Path Traversal Vulnerability (CVSS 10.0) — exploited
• CVE-2026-1728 — Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover (CVSS 9.8)
• CVE-2026-0637 — Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products (CVSS 4.4)
• CVE-2025-15039 — Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products (CVSS 9.4)
• CVE-2025-13394 — Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions (CVSS 5.4)
• CVE-2024-8995 — Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access (CVSS 4.9)
• CVE-2024-6832 — Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks (CVSS 7.5)
• CVE-2024-10302 — Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure (CVSS 5.8)
• CVE-2026-4249 — Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption (CVSS 8.6)
• CVE-2025-8591 — Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification (CVSS 6.1)
• CVE-2025-8325 — Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations (CVSS 8.8)
• CVE-2025-8154 — HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation (CVSS 7.5)
• CVE-2025-13590 — Authenticated arbitrary file upload via a System REST API requiring administrator permission. (CVSS 7.2)
• CVE-2025-9312 — Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products (CVSS 9.8)
• CVE-2025-6670 — Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services (CVSS 8.8)
• CVE-2025-10853 — Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding (CVSS 6.1)
• CVE-2025-11093 — Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) (CVSS 7.2)
• CVE-2025-10907 — Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution (CVSS 7.2)
• CVE-2025-10713 — XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration (CVSS 9.1)
• CVE-2025-3125 — Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution (CVSS 7.2)
• CVE-2025-5605 — Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure (CVSS 5.3)