WSO2 API Manager vulnerabilities and fixes
Exploited and high-severity WSO2 API Manager vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 9.8CVE-2026-4052Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)Fix availableWSO2 WSO2 API Manager
1 min read - 8.7CVE-2026-2613SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service DisruptionFix availableWSO2 WSO2 API Manager
1 min read - 9.4CVE-2025-11969Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative ActionsFix availableWSO2 WSO2 API Manager
1 min read - 8.3CVE-2025-14260Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External ResourcesFix availableWSO2 WSO2 API Manager
1 min read