What’s Vulnerable › Products

WSO2 Carbon API Management Implementation vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your WSO2 Carbon API Management Implementation version is affected

Latest WSO2 Carbon API Management Implementation vulnerabilities

• CVE-2026-3418 — Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution (CVSS 9.1)
• CVE-2025-14561 — Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations (CVSS 9.0)
• CVE-2026-3415 — XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service (CVSS 8.7)