CVE-2026-3415: XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

Severity: high (CVSS 8.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-06 · updated 2026-10-28
Weakness: CWE-776

Description

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

Affected products

WSO2 Api Control Plane: from 4.5.0 before 4.5.0.54; from 4.6.0 before 4.6.0.17 — fixed in 4.5.0.54, 4.6.0.17
WSO2 API Manager: from 3.2.0 before 3.2.0.472; from 3.2.1 before 3.2.1.91; from 4.1.0 before 4.1.0.254; from 4.2.0 before 4.2.0.194; from 4.3.0 before 4.3.0.105; from 4.4.0 before 4.4.0.68 — fixed in 3.2.0.472, 3.2.1.91, 4.1.0.254, 4.2.0.194, 4.3.0.105, 4.4.0.68
WSO2 Traffic Manager: from 4.5.0 before 4.5.0.52; from 4.6.0 before 4.6.0.16 — fixed in 4.5.0.52, 4.6.0.16
WSO2 Universal Gateway: from 4.5.0 before 4.5.0.53; from 4.6.0 before 4.6.0.16 — fixed in 4.5.0.53, 4.6.0.16
WSO2 Carbon API Gateway: from 6.7.206 before 6.7.206.594; from 6.7.210 before 6.7.210.95; from 9.20.74 before 9.20.74.398; from 9.28.116 before 9.28.116.412; from 9.29.120 before 9.29.120.228; from 9.30.67 before 9.30.67.158 — fixed in 6.7.206.594, 6.7.210.95, 9.20.74.398, 9.28.116.412, 9.29.120.228, 9.30.67.158
WSO2 Carbon API Management Implementation: from 6.7.206 before 6.7.206.594; from 6.7.210 before 6.7.210.95; from 9.20.74 before 9.20.74.398; from 9.28.116 before 9.28.116.412; from 9.29.120 before 9.29.120.228; from 9.30.67 before 9.30.67.158 — fixed in 6.7.206.594, 6.7.210.95, 9.20.74.398, 9.28.116.412, 9.29.120.228, 9.30.67.158

How to fix

Upgrade to a fixed version: WSO2 Api Control Plane 4.5.0.54, 4.6.0.17; WSO2 API Manager 3.2.0.472, 3.2.1.91, 4.1.0.254, 4.2.0.194; WSO2 Traffic Manager 4.5.0.52, 4.6.0.16; WSO2 Universal Gateway 4.5.0.53, 4.6.0.16; WSO2 Carbon API Gateway 6.7.206.594, 6.7.210.95, 9.20.74.398, 9.28.116.412; WSO2 Carbon API Management Implementation 6.7.206.594, 6.7.210.95, 9.20.74.398, 9.28.116.412. Check the vendor advisory for mitigations.

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/

Get alerted when CVE-2026-3415 or the next vulnerability affects your stack