WSO2 Product CVE Justifications¶
This section contains clarifications and justifications for the CVEs that are associated with WSO2 products and do not require fixes.
| ID | WSO2 products | WSO2 Products impacted | Customer action required | Published |
|---|---|---|---|---|
| CVE-2026-71497 | WSO2 Micro Integrator, WSO2 Integration Control Plane, WSO2 API Manager, WSO2 API Control Plane, WSO2 Universal Gateway, WSO2 Traffic Manager, WSO2 Identity Server | No | No | October 19, 2026 |
| CVE-2026-49875 | WSO2 API Manager, WSO2 API Control Plane, WSO2 Universal Gateway, WSO2 Traffic Manager | No | No | June 30, 2026 |
| CVE-2026-47886 | WSO2 Identity Server | No | No | October 13, 2026 |
| CVE-2026-44825 | WSO2 API Manager | No | No | September 24, 2026 |
| CVE-2026-43869 | WSO2 Identity Server | Limited | Yes (apply the latest product update) | October 14, 2026 |
| CVE-2026-41851 | WSO2 Identity Server | No | No | June 26, 2026 |
| CVE-2026-41848 | WSO2 Identity Server | No | No | June 26, 2026 |
| CVE-2026-19203 | WSO2 Identity Server | No | No | October 15, 2026 |
| CVE-2026-18401 | WSO2 Identity Server | No | No | April 17, 2026 |
| CVE-2026-2332 | WSO2 API Manager, WSO2 Identity Server | No | No | April 29, 2026 |
| CVE-2025-66516 | WSO2 API Manager | No | No | December 12, 2025 |
| CVE-2025-59340 | WSO2 API Manager, WSO2 Identity Server, WSO2 Integrator: MI, WSO2 Enterprise Integrator | Limited | No | September 20, 2025 |
| CVE-2025-48924 | WSO2 API Manager, WSO2 Identity Server | No | No | November 7, 2025 |
| CVE-2025-48913 | WSO2 API Manager, WSO2 Identity Server | No | No | September 30, 2025 |
| CVE-2025-47889 | No | No | May 14, 2025 | |
| CVE-2025-46392 | WSO2 Identity Server, WSO2 API Manager | No | No | July 31, 2025 |
| CVE-2025-41249 | WSO2 Identity Server, WSO2 API Manager | No | No | September 16, 2025 |
| CVE-2025-22874 | WSO2 Choreo Connect | No | No | June 19, 2025 |
| CVE-2025-11143 | WSO2 API Manager, WSO2 Identity Server | No | No | April 20, 2026 |
| CVE-2024-38820 | WSO2 Identity Server | No | Yes | June 4, 2026 |
| CVE-2024-6763 | WSO2 Identity Server, WSO2 API Manager, WSO2 API Control Plane, WSO2 Universal Gateway, WSO2 Traffic Manager, WSO2 Micro Integrator Dashboard, WSO2 Integration Control Plane | No | No | February 24, 2025 |
| CVE-2023-52428 | WSO2 Identity Server | No | No | February 12, 2025 |
| CVE-2023-49735 | WSO2 API Manager, WSO2 Identity Server | No | No | April 30, 2026 |
| CVE-2023-39017 | WSO2 API Manager | No | No | May 11, 2026 |
| CVE-2022-45868 | WSO2 API Manager, WSO2 Open Banking AM | No | No | July 24, 2024 |
| CVE-2022-42889 | No | Yes | October 26, 2022 | |
| CVE-2022-36313 | WSO2 API Manager | No | No | November 24, 2025 |
| CVE-2022-29464 | No | No | August 21, 2024 | |
| CVE-2022-23307 | No | No | January 28, 2022 | |
| CVE-2022-23305 | No | No | January 28, 2022 | |
| CVE-2022-23302 | No | No | January 28, 2022 | |
| CVE-2022-23221 | WSO2 API Manager | No | No | October 30, 2024 |
| CVE-2022-22965 | WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Enterprise Integrator | No | No | April 11, 2022 |
| CVE-2022-3786 | No | No | November 4, 2022 | |
| CVE-2022-3602 | No | No | November 4, 2022 | |
| CVE-2021-42646 | WSO2 API Manager, WSO2 Identity Server, WSO2 Identity Server as Key Manager | No | No | June 2, 2025 |
| CVE-2021-42392 | No | No | January 13, 2022 | |
| CVE-2021-28490 | WSO2 API Manager | No | No | April 30, 2026 |
| CVE-2021-23463 | WSO2 API Manager | No | No | October 30, 2024 |
| CVE-2020-13226 | WSO2 API Manager | No | No | June 10, 2020 |
| CVE-2020-11023 | WSO2 API Manager | No | No | February 18, 2026 |
| CVE-2020-11022 | WSO2 API Manager | No | No | February 18, 2026 |
| CVE-2020-7656 | WSO2 API Manager | No | No | February 18, 2026 |
| CVE-2020-1938 | WSO2 API Manager, WSO2 Identity Server, WSO2 Enterprise Integrator, WSO2 Stream Processor | No | No | March 2, 2020 |
| CVE-2019-17571 | WSO2 API Manager, WSO2 Enterprise Integrator, WSO2 Identity Server, WSO2 Stream Processor | No | No | March 12, 2020 |
| CVE-2019-11358 | WSO2 API Manager | No | No | February 18, 2026 |
| CVE-2019-6515 | WSO2 API Manager | February 28, 2019 | ||
| CVE-2019-6513 | WSO2 API Manager | No | No | November 19, 2020 |
| CVE-2019-6512 | WSO2 API Manager | February 28, 2019 | ||
| CVE-2017-15708 | WSO2 API Manager, WSO2 Micro Integrator, WSO2 Enterprise Integrator | No | No | February 25, 2025 |
| CVE-2016-1000027 | WSO2 API Manager, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Enterprise Integrator | No | No | May 22, 2025 |
| CVE-2015-9251 | WSO2 API Manager | No | No | February 18, 2026 |
| CVE-2014-3623 | WSO2 API Manager | October 30, 2014 | ||
| CVE-2013-6780 | WSO2 API Manager | No | No | October 20, 2025 |
| CVE-2012-6708 | WSO2 API Manager | No | No | February 18, 2026 |
| CVE-2012-6153 | WSO2 Identity Server | No | No | October 14, 2026 |
| CVE-2012-5883 | WSO2 API Manager | No | No | November 13, 2025 |
| CVE-2012-5882 | WSO2 API Manager | No | No | November 13, 2025 |
| CVE-2012-5881 | WSO2 API Manager | No | No | November 13, 2025 |
| CVE-2012-5783 | WSO2 API Manager | No | No | July 8, 2026 |
| Bluebird Memory Leak Vulnerability (NPM) | WSO2 API Manager | No | No | June 15, 2026 |
| GHSA-593m-55hh-j8gv | WSO2 API Manager | No (transitive dependency) | No | September 1, 2025 |
| ZDI-CAN-13449 | WSO2 API Manager | July 28, 2021 |