Vendor

WSO2

2 of 5 WSO2 CVEs in Patchfirst (40%) are in of vulnerabilities exploited in the wild, 1 of them used by ransomware.

CVEs: 5
In CISA KEV: 240%
Known ransomware use: 1
Median days to KEV: 28; from publication
Latest KEV listing: 24 Sep 2026

Watch WSO2 Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Multiple Products In KEV: 2 CVEs: 2
WSO2 Enterprise Integrator In KEV: 0 CVEs: 1
WSO2 Identity Server In KEV: 0 CVEs: 1
WSO2 Open Banking AM In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with WSO2 CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 2
T1202Indirect Command Execution CVEs: 1
T1496Resource Hijacking CVEs: 1
T1078Valid Accounts CVEs: 1
T1550Use Alternate Authentication Material CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/wso2.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are WSO2 CVEs linked to the technique. Each link’s provenance is on the CVE page.

WSO2 CVEs

5 CVEs, by priority

CVE-2022-29464WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
WSO2 · Multiple ProductsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1202Indirect Command Execution+1 more
>99.9%Top 0.01%
79.9priority
CVE-2026-5430WSO2 Multiple Products Path Traversal Vulnerability
WSO2 · Multiple ProductsKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1078Valid Accounts+1 more
22.4%Top 2.3%
79.5priority
CVE-2025-5605Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial…
WSO2 · WSO2 Identity ServerPublic exploitMedium · 4.3
0.9%Top 42%
61.0priority
CVE-2024-7097Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
WSO2 · WSO2 Open Banking AMPublic exploitMedium · 4.3
0.7%Top 49%
54.7priority
CVE-2024-4457The Management Console fails to properly validate input related to the configuration of JDBC user stores
WSO2 · WSO2 Enterprise IntegratorCritical · 9.1
0.4%Top 64%
15.2priority