WSO2 Security and Compliance Documentation

Security and compliance resources for WSO2 products and cloud services, covering secure engineering practices, deployment hardening guidance, vulnerability management processes, and public security advisories. WSO2 is a CVE Numbering Authority (CNA).

Found a security issue? Report it privately through the appropriate WSO2 security reporting channel. See the vulnerability reporting guidelines for what to include.

Latest Security Advisories

The newest advisories for WSO2 products. See all security advisories, by year.

Advisory	Summary	Severity	Published
WSO2-2026-5692 CVE-2026-78674	Authenticated Remote Code Execution vulnerability via BPMN System REST APIs	High	October 28, 2026
WSO2-2026-5680	Essential Security Enhancement	Not Applicable	October 28, 2026
WSO2-2026-5387 CVE-2026-6647	Incomplete OAuth token revocation when user store and database case-sensitivity are inconsistent	High	October 28, 2026
WSO2-2026-5175 CVE-2026-3583	OAuth2 token revocation behavior mismatch when allowed_scopes is enabled	Low	October 28, 2026
WSO2-2026-5158	Essential security enhancement in OTP resend flows	Not Applicable	October 28, 2026
WSO2-2025-4850 CVE-2026-11854	Reflected Cross-Site Scripting (XSS) vulnerability in the authentication endpoint	Medium	October 28, 2026
WSO2-2025-4050 CVE-2025-14260	Authenticated Server Side Request Forgery (SSRF)	High	October 28, 2026
WSO2-2026-5854 CVE-2026-19515	OS command injection vulnerability in the WSO2 Integrator: MI VS Code extension via unit test run	High	September 15, 2026
WSO2-2026-5174 CVE-2026-3416	Predictable webhook HMAC secrets due to the use of non-cryptographic pseudorandom number generation	Medium	July 4, 2026
WSO2-2026-5164 CVE-2026-3096	Potential Reverse Tabnabbing	Medium	July 4, 2026

Security Processes

Organizational security workflows, governance, incident handling, and vulnerability management practices.

Processes & Programs

Secure software development lifecycle, vulnerability management workflow, cloud security controls aligned with the CSA DevSecOps pillars, and the SaaS incident notification process.

Secure Software Development → Vulnerability Management → Cloud Security Process → SaaS Incident Notification →

Security Guidelines

Technical implementation guidance for secure engineering and hardened deployments.

Engineering & Operations

Secure coding standards, OWASP Top 10 prevention, security analysis tooling for WSO2 product teams, and hardening guidance for production deployments.

Secure Coding Guide → OWASP Top 10 - 2025 Prevention → Production Deployment Hardening →

Security Announcements

Product advisories, CVE analysis, cloud security bulletins, and clarifications on industry incidents relevant to WSO2 products and customers.

Security Advisories

Public advisories for confirmed vulnerabilities in WSO2 products, including affected versions, CVSS severity, assigned CVE IDs, and the recommended fix or mitigation.

Security Advisories →

Third-Party CVE Analysis

Assessment of third-party CVEs flagged against WSO2 products, covering whether each CVE is exploitable in the WSO2 context, the reasoning, and any required customer action or mitigation.

Third-Party CVE Analysis →

Cloud Security Bulletins

Periodic bulletins for WSO2 cloud services (Asgardeo, Choreo, and the WSO2 API Platform) that summarize security events and changes within each reporting period.

Cloud Security Bulletins →

Incident Clarifications

Analysis and clarifications for public security incidents and supply-chain events relevant to WSO2 products and services, covering the impact assessment and any required customer action.

Incident Clarifications →

Reporting

Channels for reporting vulnerabilities, abuse, and malicious content, alongside the researcher reward and acknowledgement program.

Report an Issue

Private mailing lists (with GPG keys) for reporting vulnerabilities in WSO2 products and infrastructure, and guidance on what to include in a report.

Report Security Issues → Vulnerability Reporting Guidelines → Report Abuse or Malicious Content →

Reward & Acknowledgement

Eligibility criteria for the reward program and the Security Hall of Fame listing researchers acknowledged for past disclosures.

Reward Program → Security Hall of Fame →