{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T20:14:26.850Z", "lastRun": "2026-10-23T20:01:03.754Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "wso2" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-5430", "url": "https://cveboard.org/i/cve-2026-5430", "urlPt": "https://cveboard.org/pt/i/cve-2026-5430", "json": "https://cveboard.org/i/cve-2026-5430.json", "kind": "vuln", "live": false, "knownExploited": true, "severity": "critical", "title": "WSO2 Multiple Products Path Traversal Vulnerability", "summary": "WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.", "titlePt": "Vulnerabilidade de Path Traversal em Múltiplos Produtos da WSO2", "summaryPt": "WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contêm uma vulnerabilidade de path traversal que pode permitir o upload de arquivos sem restrições e levar à execução remota de código.", "affected": [ { "vendor": "WSO2", "product": "WSO2 Universal Gateway", "defaultStatus": "unaffected", "versions": [ { "version": "4.5.0", "status": "affected", "lessThan": "4.5.0.57", "lessThanOrEqual": null }, { "version": "4.6.0", "status": "affected", "lessThan": "4.6.0.21", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "4.5.0.57", "4.6.0.21" ] }, { "vendor": "WSO2", "product": "WSO2 Traffic Manager", "defaultStatus": "unaffected", "versions": [ { "version": "4.5.0", "status": "affected", "lessThan": "4.5.0.56", "lessThanOrEqual": null }, { "version": "4.6.0", "status": "affected", "lessThan": "4.6.0.21", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "4.5.0.56", "4.6.0.21" ] }, { "vendor": "WSO2", "product": "WSO2 API Control Plane", "defaultStatus": "unaffected", "versions": [ { "version": "4.5.0", "status": "affected", "lessThan": "4.5.0.58", "lessThanOrEqual": null }, { "version": "4.6.0", "status": "affected", "lessThan": "4.6.0.22", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "4.5.0.58", "4.6.0.22" ] }, { "vendor": "WSO2", "product": "WSO2 API Manager", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "unknown", "lessThan": "4.1.0", "lessThanOrEqual": null }, { "version": "4.1.0", "status": "affected", "lessThan": "4.1.0.257", "lessThanOrEqual": null }, { "version": "4.2.0", "status": "affected", "lessThan": "4.2.0.197", "lessThanOrEqual": null }, { "version": "4.3.0", "status": "affected", "lessThan": "4.3.0.108", "lessThanOrEqual": null }, { "version": "4.4.0", "status": "affected", "lessThan": "4.4.0.72", "lessThanOrEqual": null }, { "version": "4.5.0", "status": "affected", "lessThan": "4.5.0.57", "lessThanOrEqual": null }, { "version": "4.6.0", "status": "affected", "lessThan": "4.6.0.21", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "4.1.0.257", "4.2.0.197", "4.3.0.108", "4.4.0.72", "4.5.0.57", "4.6.0.21" ] }, { "vendor": "WSO2", "product": "WSO2 Carbon API Manager Rest API Utility", "defaultStatus": "unknown", "versions": [ { "version": "9.20.74", "status": "affected", "lessThan": "9.20.74.401", "lessThanOrEqual": null }, { "version": "9.28.116", "status": "affected", "lessThan": "9.28.116.417", "lessThanOrEqual": null }, { "version": "9.29.120", "status": "affected", "lessThan": "9.29.120.236", "lessThanOrEqual": null }, { "version": "9.30.67", "status": "affected", "lessThan": "9.30.67.167", "lessThanOrEqual": null }, { "version": "9.31.86", "status": "affected", "lessThan": "9.31.86.158", "lessThanOrEqual": null }, { "version": "9.32.147", "status": "affected", "lessThan": "9.32.147.59", "lessThanOrEqual": null }, { "version": "9.33.106", "status": "unaffected", "lessThan": null, "lessThanOrEqual": "*" } ], "omitted": 0, "fixed": [ "9.20.74.401", "9.28.116.417", "9.29.120.236", "9.30.67.167", "9.31.86.158", "9.32.147.59", "9.33.106" ] } ], "omitted": 0, "references": [ { "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-347", "name": "Improper Validation of Certificate With Host Mismatch" } ], "ssvc": { "exploitation": "active", "automatable": "yes", "impact": "total", "at": "2026-09-24T00:00:00.000Z" }, "fix": "listed", "tags": [ "wso2" ], "cves": [ "CVE-2026-5430" ], "ghsa": null, "cvss": { "score": 10, "version": "3.1", "by": "WSO2" }, "epss": { "percentage": 0.00588, "percentile": 0.47448, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "WSO2", "product": "Multiple Products", "kev": { "dateAdded": "2026-09-24", "dueDate": "2026-09-27", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430" } ], "publishedAt": "2026-09-24T00:00:00.000Z", "updatedAt": "2026-09-24T00:00:00.000Z" } ], "tag": { "tag": "wso2", "name": "WSO2", "kev": { "name": "WSO2", "total": 2, "last": "2026-09-24" } } }