WSO2 Multiple Products Path Traversal to RCE
WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway contain a path traversal flaw enabling unauthenticated file upload and remote code execution. CVSS 10.0. Actively exploited since September 13, 2026; added to CISA KEV September 24.
- Vendor
- WSO2
- Product
- API Control Plane, API Manager, Traffic Manager, Universal Gateway
- CVSS
- 10.0
- EPSS (exploit probability)
- 22.4%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-5430 being exploited?
Yes. CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 22.4% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-5430 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
A path traversal vulnerability in WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway allows an unauthenticated attacker to traverse directory paths, upload arbitrary files, and achieve remote code execution. No credentials or user interaction required.
WSO2 disclosed the flaw on August 6, 2026. Exploitation in enterprise environments was confirmed by September 13. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 24, 2026, with a BOD 26-04 remediation deadline of September 27 for federal civilian agencies.
CVSS base score is 10.0 in multi-tenant deployments. Patch via WSO2’s security advisory portal for your specific product version. If patching immediately is not possible, restrict external network access to WSO2 management interfaces and block affected upload paths at the perimeter.
Primary source: NVD CVE-2026-5430. Coverage: WSO2 CVSS 10 JWT Bypass Exploited in the Wild.
Other WSO2 CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2022-29464 WSO2 Multiple Products Unrestrictive Upload of File Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% |
