What’s Vulnerable › Products

WSO2 Traffic Manager vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your WSO2 Traffic Manager version is affected

Latest WSO2 Traffic Manager vulnerabilities

• CVE-2025-7203 — Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials (CVSS 4.9)
• CVE-2025-6623 — Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection (CVSS 4.3)
• CVE-2025-13173 — Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination (CVSS 6.5)
• CVE-2025-5802 — Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.3)
• CVE-2026-3418 — Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution (CVSS 9.1)
• CVE-2025-14561 — Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations (CVSS 9.0)