https://security.docs.wso2.com/en/latest/Security advisories, CVE justifications, incident clarifications, and cloud security bulletins published by WSO2.enWed, 04 Nov 2026 00:00:00 +0000https://security.docs.wso2.com/en/latest/security-announcements/cloud-security-bulletins/wso2-identity-platform/2026/wso2-identity-platform-2026-h1/https://security.docs.wso2.com/en/latest/security-announcements/cloud-security-bulletins/wso2-identity-platform/2026/wso2-identity-platform-2026-h1/Wed, 04 Nov 2026 00:00:00 +0000Cloud Security BulletinThis bulletin summarizes security vulnerabilities addressed during the H1 of 2026 for WSO2 Identity Platform.https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5692/Wed, 28 Oct 2026 00:00:00 +0000Security AdvisoryCVE-2026-78674: Authenticated Remote Code Execution vulnerability via BPMN System REST APIs. Affects WSO2 Enterprise Integrator and WSO2 Business Process Server. Severity: High (CVSS 8.8).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5680/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5680/Wed, 28 Oct 2026 00:00:00 +0000Security AdvisoryWSO2-2026-5680: Essential Security Enhancement. Affects WSO2 APK.https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5387/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5387/Wed, 28 Oct 2026 00:00:00 +0000Security AdvisoryCVE-2026-6647: Incomplete OAuth token revocation when user store and database case-sensitivity are inconsistent. Affects WSO2 Identity Server. Severity: High (CVSS 7.4).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/Wed, 28 Oct 2026 00:00:00 +0000Security AdvisoryCVE-2026-3583: OAuth2 token revocation behavior mismatch when allowed_scopes is enabled. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Identity Server as Key Manager, and 5 other products. Severity: Low (CVSS 3.1).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5158/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5158/Wed, 28 Oct 2026 00:00:00 +0000Security AdvisoryWSO2-2026-5158: Essential security enhancement in OTP resend flows. Affects WSO2 Identity Server.https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4850/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4850/Wed, 28 Oct 2026 00:00:00 +0000Security AdvisoryCVE-2026-11854: Reflected Cross-Site Scripting (XSS) vulnerability in the authentication endpoint. Affects WSO2 API Control Plane, WSO2 API Manager, and WSO2 Identity Server. Severity: Medium (CVSS 6.1).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/Wed, 28 Oct 2026 00:00:00 +0000Security AdvisoryCVE-2025-14260: Authenticated Server Side Request Forgery (SSRF). Affects WSO2 API Manager, WSO2 Identity Server as Key Manager, WSO2 Identity Server, and 2 other products. Severity: High (CVSS 8.3).https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-71497/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-71497/Mon, 19 Oct 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2026-71497 in multiple WSO2 products. WSO2 products impacted: No. Customer action required: No. Reported issue: When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The...https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-19203/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-19203/Thu, 15 Oct 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2026-19203 in WSO2 Identity Server. WSO2 products impacted: No. Customer action required: No. Reported issue: A client may send specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret request boundaries...https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-43869/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-43869/Wed, 14 Oct 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2026-43869 in WSO2 Identity Server. WSO2 products impacted: Limited. Customer action required: Yes (apply the latest product update). Reported issue: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift...https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2012-6153/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2012-6153/Wed, 14 Oct 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2012-6153 in WSO2 Identity Server. WSO2 products impacted: No. Customer action required: No. Reported issue: Apache Commons HttpClient does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the...https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-47886/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-47886/Tue, 13 Oct 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2026-47886 in WSO2 Identity Server. WSO2 products impacted: No. Customer action required: No. Reported issue: Spring Framework applications that accept and evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS)...https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-44825/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-44825/Thu, 24 Sep 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2026-44825 in WSO2 API Manager. WSO2 products impacted: No. Customer action required: No. Reported issue: Hardcoded credentials in Apache Solr's Basic Authentication setup tool (bin/solr auth enable) allow a remote attacker to gain full administrative access to a Solr...https://security.docs.wso2.com/en/latest/security-announcements/cloud-security-bulletins/choreo/2026/choreo-2026-h1/https://security.docs.wso2.com/en/latest/security-announcements/cloud-security-bulletins/choreo/2026/choreo-2026-h1/Wed, 23 Sep 2026 00:00:00 +0000Cloud Security BulletinThis bulletin summarizes security vulnerabilities addressed during the H1 of 2026 for Choreo.https://security.docs.wso2.com/en/latest/security-announcements/cloud-security-bulletins/choreo/2025/choreo-2025-h2/https://security.docs.wso2.com/en/latest/security-announcements/cloud-security-bulletins/choreo/2025/choreo-2025-h2/Tue, 22 Sep 2026 00:00:00 +0000Cloud Security BulletinThis bulletin summarizes security vulnerabilities addressed during the H2 of 2025 for Choreo.https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5854/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5854/Tue, 15 Sep 2026 00:00:00 +0000Security AdvisoryCVE-2026-19515: OS command injection vulnerability in the WSO2 Integrator: MI VS Code extension via unit test run. Affects WSO2 Integrator: MI for Visual Studio Code. Severity: High (CVSS 7.0).https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2012-5783/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2012-5783/Wed, 08 Jul 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2012-5783 in WSO2 API Manager. WSO2 products impacted: No. Customer action required: No. Reported issue: Apache Commons HttpClient 3.x (as used in the affected component version 3.1.0) does not verify that the server hostname matches the Common Name (CN) or Subject...https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5174/Sat, 04 Jul 2026 00:00:00 +0000Security AdvisoryCVE-2026-3416: Predictable webhook HMAC secrets due to the use of non-cryptographic pseudorandom number generation. Affects WSO2 API Control Plane and WSO2 API Manager. Severity: Medium (CVSS 5.9).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5164/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5164/Sat, 04 Jul 2026 00:00:00 +0000Security AdvisoryCVE-2026-3096: Potential Reverse Tabnabbing. Affects WSO2 API Control Plane and WSO2 API Manager. Severity: Medium (CVSS 4.7).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-4844/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-4844/Sat, 04 Jul 2026 00:00:00 +0000Security AdvisoryCVE-2026-4103: Stored XSS Vulnerability in WSO2 Publisher Portal and Developer Portal. Affects WSO2 API Control Plane and WSO2 API Manager. Severity: Medium (CVSS 6.4).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-4608/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-4608/Sat, 04 Jul 2026 00:00:00 +0000Security AdvisoryCVE-2026-3863: Authenticated Denial-of-Service (DoS) vulnerability. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway. Severity: Medium (CVSS 4.9).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4227/Sat, 04 Jul 2026 00:00:00 +0000Security AdvisoryCVE-2025-5802: Potential username enumeration in self registration flow. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Identity Server, and 5 other products. Severity: Medium (CVSS 5.3).https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-49875/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-49875/Tue, 30 Jun 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2026-49875 in multiple WSO2 products. WSO2 products impacted: No. Customer action required: No. Reported issue: Apache CXF has an XML External Entity (XXE) vulnerability in the EndpointReferenceUtils and W3CMultiSchemaFactory classes. These classes construct a...https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-41851/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-41851/Fri, 26 Jun 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2026-41851 in WSO2 Identity Server. WSO2 products impacted: No. Customer action required: No. Reported issue: Spring Framework applications that accept and evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS)...https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-41848/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2026-41848/Fri, 26 Jun 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2026-41848 in WSO2 Identity Server. WSO2 products impacted: No. Customer action required: No. Reported issue: Spring Framework's AntPathMatcher is vulnerable to a Regular Expression Denial of Service (ReDoS) attack . A crafted Ant-style pattern is compiled into a...https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/Thu, 18 Jun 2026 00:00:00 +0000Security AdvisoryCVE-2026-4052: Self-Registered User Gaining Admin Privileges (APIM 4.x/IS as Resident Key Manager). Affects WSO2 API Control Plane and WSO2 API Manager. Severity: Critical (CVSS 9.8).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5051/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5051/Thu, 18 Jun 2026 00:00:00 +0000Security AdvisoryWSO2-2026-5051: Essential Security enhancement for API Manager's Script Mediators. Affects WSO2 API Manager.https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/Thu, 18 Jun 2026 00:00:00 +0000Security AdvisoryCVE-2025-12544: Authenticated Stored Cross-Site Scripting (XSS). Affects WSO2 API Manager. Severity: Medium (CVSS 4.8).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4493/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4493/Thu, 18 Jun 2026 00:00:00 +0000Security AdvisoryCVE-2025-11850: Potential improper implicit association. Affects WSO2 Identity Server. Severity: Medium (CVSS 4.3).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-1613/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-1613/Thu, 18 Jun 2026 00:00:00 +0000Security AdvisoryCVE-2025-13475: Potential cross-tenant access via application consent mismanagement in multi-tenanted deployments. Affects WSO2 API Manager and WSO2 Identity Server. Severity: Low (CVSS 3.5).https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/bluebird-memory-leak-vulnerability-npm/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/bluebird-memory-leak-vulnerability-npm/Mon, 15 Jun 2026 00:00:00 +0000CVE JustificationWSO2 analysis of Bluebird Memory Leak Vulnerability (NPM) in WSO2 API Manager. WSO2 products impacted: No. Customer action required: No. Reported issue: The bluebird package has a reported memory leak when the longStackTraces() function is run with the --expose_gc flag. This can significantly...https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2024-38820/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2024-38820/Thu, 04 Jun 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2024-38820 in WSO2 Identity Server. WSO2 products impacted: No. Customer action required: Yes. Reported issue: This vulnerability affects spring-context because it builds on the DataBinder functionality in spring-core. The fix for CVE-2022-22968 made disallowedFields...https://security.docs.wso2.com/en/latest/security-announcements/incident-clarifications/2026/unauthorized-access-to-githubs-internal-repositories/https://security.docs.wso2.com/en/latest/security-announcements/incident-clarifications/2026/unauthorized-access-to-githubs-internal-repositories/Fri, 22 May 2026 00:00:00 +0000Incident ClarificationOn May 20, 2026, WSO2 was informed of a security incident announced by GitHub regarding unauthorized access to its internal repositories.https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2023-39017/https://security.docs.wso2.com/en/latest/security-announcements/cve-justifications/2026/CVE-2023-39017/Mon, 11 May 2026 00:00:00 +0000CVE JustificationWSO2 analysis of CVE-2023-39017 in WSO2 API Manager. WSO2 products impacted: No. Customer action required: No. Reported issue: Quartz-jobs versions 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This...https://security.docs.wso2.com/en/latest/security-announcements/cloud-security-bulletins/wso2-identity-platform/2025/wso2-identity-platform-2025-h2/https://security.docs.wso2.com/en/latest/security-announcements/cloud-security-bulletins/wso2-identity-platform/2025/wso2-identity-platform-2025-h2/Wed, 06 May 2026 00:00:00 +0000Cloud Security BulletinThis bulletin summarizes security vulnerabilities addressed during the H2 of 2025 for WSO2 Identity Platform.https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2026-5430: Account takeover via authentication bypass vulnerability. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway. Severity: Critical (CVSS 10.0).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2026-4249: Denial of service vulnerability. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway. Severity: High (CVSS 8.6).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2026-3418: Authenticated arbitrary file upload via a System REST API. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway. Severity: Critical (CVSS 9.1).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2026-2613: SQL injection vulnerability in the Admin REST API. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway. Severity: High (CVSS 8.7).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2026-1728: Privilege escalation vulnerability in System REST APIs. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway. Severity: Critical (CVSS 9.8).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5072/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5072/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2026-2053: Unauthenticated Server Side Request Forgery (SSRF) in WS Addressing. Affects WSO2 API Manager. Severity: High (CVSS 8.3).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2026-2445: Reflected Cross-Site Scripting (XSS) vulnerability. Affects WSO2 API Control Plane, WSO2 API Manager, and WSO2 Identity Server. Severity: Medium (CVSS 6.1).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5039/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5039/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2025-5717: Arbitrary Remote Code Execution vulnerability via the Siddhi Try It feature. Affects WSO2 API Manager Analytics, WSO2 API Manager, WSO2 Enterprise Integrator, and WSO2 Identity Server Analytics. Severity: Critical (CVSS 10.0).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5002/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5002/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryWSO2-2026-5002: Essential Security Enhancements. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Identity Server as Key Manager, and 3 other products.https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2026-3415: XML External Entity (XXE) injection vulnerability in XMLSchemaValidator Mediator. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, and WSO2 Universal Gateway. Severity: High (CVSS 8.7).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2026-18800: Potential disclosure of sensitive information via Event Publisher warn logs. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Identity Server as Key Manager, and 5 other products. Severity: Medium (CVSS 4.4).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4891/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4891/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryWSO2-2025-4891: Essential Security Enhancements. Affects WSO2 API Manager and WSO2 Open Banking AM.https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4829/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4829/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2026-0637: Potential header injection. Affects WSO2 API Control Plane and WSO2 API Manager. Severity: Medium (CVSS 5.4).https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/Sun, 03 May 2026 00:00:00 +0000Security AdvisoryCVE-2025-13394: Cross Site Request Forgery (CSRF) in Ajax Processor Endpoints. Affects WSO2 API Control Plane, WSO2 API Manager, WSO2 Enterprise Integrator, and 6 other products. Severity: Medium (CVSS 5.4).