CVE-2021-1630

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-05 · updated 2026-06-17
Weakness: CWE-611

Description

XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and on-premise customers.

Affected products

Mulesoft: from 3.0.0 before 4.3.0 — fixed in 4.3.0

How to fix

Upgrade to a fixed version: Mulesoft 4.3.0. Check the vendor advisory for mitigations.

References

https://help.salesforce.com/articleView?id=000362693&type=1&mode=1
https://help.salesforce.com/articleView?id=000362693&type=1&mode=1

Get alerted when CVE-2021-1630 or the next vulnerability affects your stack