{"cve":{"cve_id":"CVE-2026-5430","is_kev":true,"kev_date_added":"2026-09-24","kev_vendor_project":"WSO2","kev_product":"Multiple Products","kev_vulnerability_name":"WSO2 Multiple Products Path Traversal Vulnerability ","kev_short_description":"WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. ","kev_required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","kev_due_date":"2026-09-27","kev_known_ransomware":false,"kev_notes":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-5430","kev_cwes":["CWE-347"],"epss_score":0.00588,"epss_percentile":0.46952,"epss_as_of":"2026-10-15","description":"The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.\n\nSuccessful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.","published_at":"2026-08-06T07:33:28.156000Z","last_modified_at":"2026-09-25T12:53:05.517000Z","cvss_v3_score":10.0,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_v3_severity":"CRITICAL","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":"none","ssvc_automatable":true,"ssvc_technical_impact":"total","cwes":["CWE-347"],"nvd_references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/"],"vuln_status":"Analyzed","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-08-06T09:40:38.292062Z","updated_at":"2026-09-26T05:38:24.218835Z"},"effective_severity":"CRITICAL","badges":["kev","news"],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"C","value_label":"Changed"},{"metric":"C","name":"Confidentiality","value":"H","value_label":"High"},{"metric":"I","name":"Integrity","value":"H","value_label":"High"},{"metric":"A","name":"Availability","value":"H","value_label":"High"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"api-control-plane","product_name":"api_control_plane","version_start":"4.5.0","version_start_inclusive":true,"version_end":"4.5.0.58","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"api-manager","product_name":"api_manager","version_start":"4.1.0","version_start_inclusive":true,"version_end":"4.1.0.257","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"traffic-manager","product_name":"traffic_manager","version_start":"4.5.0","version_start_inclusive":true,"version_end":"4.5.0.56","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"universal-gateway","product_name":"universal_gateway","version_start":"4.5.0","version_start_inclusive":true,"version_end":"4.5.0.57","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-api-control-plane","product_name":"WSO2 API Control Plane","version_start":"4.5.0","version_start_inclusive":true,"version_end":"4.5.0.58","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-api-control-plane:4.5.0:4.5.0.58"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-api-control-plane","product_name":"WSO2 API Control Plane","version_start":"4.6.0","version_start_inclusive":true,"version_end":"4.6.0.22","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-api-control-plane:4.6.0:4.6.0.22"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-api-manager","product_name":"WSO2 API Manager","version_start":"4.5.0","version_start_inclusive":true,"version_end":"4.5.0.57","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-api-manager:4.5.0:4.5.0.57"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-api-manager","product_name":"WSO2 API Manager","version_start":"4.6.0","version_start_inclusive":true,"version_end":"4.6.0.21","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-api-manager:4.6.0:4.6.0.21"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-api-manager","product_name":"WSO2 API Manager","version_start":"0","version_start_inclusive":true,"version_end":"4.1.0","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-api-manager:0:4.1.0"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-api-manager","product_name":"WSO2 API Manager","version_start":"4.1.0","version_start_inclusive":true,"version_end":"4.1.0.257","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-api-manager:4.1.0:4.1.0.257"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-api-manager","product_name":"WSO2 API Manager","version_start":"4.2.0","version_start_inclusive":true,"version_end":"4.2.0.197","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-api-manager:4.2.0:4.2.0.197"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-api-manager","product_name":"WSO2 API Manager","version_start":"4.3.0","version_start_inclusive":true,"version_end":"4.3.0.108","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-api-manager:4.3.0:4.3.0.108"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-api-manager","product_name":"WSO2 API Manager","version_start":"4.4.0","version_start_inclusive":true,"version_end":"4.4.0.72","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-api-manager:4.4.0:4.4.0.72"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-carbon-api-manager-rest-api-utility","product_name":"WSO2 Carbon API Manager Rest API Utility","version_start":"9.20.74","version_start_inclusive":true,"version_end":"9.20.74.401","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-carbon-api-manager-rest-api-utility:9.20.74:9.20.74.401"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-carbon-api-manager-rest-api-utility","product_name":"WSO2 Carbon API Manager Rest API Utility","version_start":"9.28.116","version_start_inclusive":true,"version_end":"9.28.116.417","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-carbon-api-manager-rest-api-utility:9.28.116:9.28.116.417"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-carbon-api-manager-rest-api-utility","product_name":"WSO2 Carbon API Manager Rest API Utility","version_start":"9.29.120","version_start_inclusive":true,"version_end":"9.29.120.236","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-carbon-api-manager-rest-api-utility:9.29.120:9.29.120.236"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-carbon-api-manager-rest-api-utility","product_name":"WSO2 Carbon API Manager Rest API Utility","version_start":"9.30.67","version_start_inclusive":true,"version_end":"9.30.67.167","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-carbon-api-manager-rest-api-utility:9.30.67:9.30.67.167"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-carbon-api-manager-rest-api-utility","product_name":"WSO2 Carbon API Manager Rest API Utility","version_start":"9.31.86","version_start_inclusive":true,"version_end":"9.31.86.158","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-carbon-api-manager-rest-api-utility:9.31.86:9.31.86.158"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-carbon-api-manager-rest-api-utility","product_name":"WSO2 Carbon API Manager Rest API Utility","version_start":"9.32.147","version_start_inclusive":true,"version_end":"9.32.147.59","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-carbon-api-manager-rest-api-utility:9.32.147:9.32.147.59"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-carbon-api-manager-rest-api-utility","product_name":"WSO2 Carbon API Manager Rest API Utility","version_start":"9.33.106","version_start_inclusive":true,"version_end":"*","version_end_inclusive":true,"cpe23_uri":"cve5:wso2:wso2-carbon-api-manager-rest-api-utility:9.33.106:*"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-traffic-manager","product_name":"WSO2 Traffic Manager","version_start":"4.6.0","version_start_inclusive":true,"version_end":"4.6.0.21","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-traffic-manager:4.6.0:4.6.0.21"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-traffic-manager","product_name":"WSO2 Traffic Manager","version_start":"4.5.0","version_start_inclusive":true,"version_end":"4.5.0.56","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-traffic-manager:4.5.0:4.5.0.56"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-universal-gateway","product_name":"WSO2 Universal Gateway","version_start":"4.5.0","version_start_inclusive":true,"version_end":"4.5.0.57","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-universal-gateway:4.5.0:4.5.0.57"},{"vendor_slug":"wso2","vendor_name":"WSO2","product_slug":"wso2-universal-gateway","product_name":"WSO2 Universal Gateway","version_start":"4.6.0","version_start_inclusive":true,"version_end":"4.6.0.21","version_end_inclusive":false,"cpe23_uri":"cve5:wso2:wso2-universal-gateway:4.6.0:4.6.0.21"}],"exploit_refs":[],"news":[{"id":2148,"source":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-sharepoint-wso2-adobe-commerce-flaws-exploited-in-attacks/","title":"CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks","summary":"The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2. [...]","thumbnail_url":null,"author":"Bill Toulas","published_at":"2026-09-25T17:24:20Z","fetched_at":"2026-09-25T17:49:04.560368Z","trending_score":0.000029762815867368735,"cve_ids":["CVE-2026-5430"]},{"id":2102,"source":"The Hacker News","url":"https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html","title":"WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV","summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.\n\nThe vulnerabilities are listed below -\n\n\n  CVE-2026-5430 (CVS score: 9.8) - A path traversal vulnerability in  WSO2 API Control Plane,","thumbnail_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqTAzyCx7Cezy4z5oRz-uAHvdvW1IZDrQlfIqT_ZDJ22Hvarb4lmYWkjqBDI_CngiSy2wuot68b2CgMS_0CWVZS93lYo5wqJsd5-WdFQgO3dieodXpVQiizcFjQsPzUOlVrs32zkBaHAwOyD7S4GCZ3b1d-Jyt4-ZTaMltfU0jG5dwBw5cxj880D4Cx8W0/s1600/ADOBE-CISA.jpg","author":"info@thehackernews.com (The Hacker News)","published_at":"2026-09-25T04:46:34Z","fetched_at":"2026-09-25T06:34:04.712990Z","trending_score":0.000022893219789670218,"cve_ids":["CVE-2026-5430"]},{"id":1898,"source":"The Hacker News","url":"https://thehackernews.com/2026/09/active-exploitation-attempts-target.html","title":"Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens","summary":"A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr.\n\nThe vulnerability, tracked as CVE-2026-5430 (CVSS score: 9.8/10.0), is a case of improper verification of a cryptographic signature that could result in account takeover. Hacktron Team has been credited with discovering and reporting the flaw.\n\n\"JWT authentication","thumbnail_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjenXPNzZ8-fnZOSWlAtRwfZVCV0iy-vnK86gK4vmTGsWSjSS7x9a3k80NLsiEZUym2AjBaYj7pLtxyQju7Hiyl6ttQPyXEPMy7Gwn_bQTTTaUOB-8HbhJfYxl54Z3WE5yqKEoW1vvkCBukKwea-6DlpBiO6i08Zo0GhBoqgRsGGXadsOYy8COPUPQ7rn2w/s1600/jwt-api.jpg","author":"info@thehackernews.com (The Hacker News)","published_at":"2026-09-16T05:18:06Z","fetched_at":"2026-09-16T07:01:42.574528Z","trending_score":1.019454616885441e-6,"cve_ids":["CVE-2026-5430"]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/","source_type":"VENDOR_ADVISORY","tags":["advisory"]}],"timeline":[{"type":"published","at":"2026-08-06T07:33:28.156000Z","label":"CVE published","source":null},{"type":"ssvc_changed","at":"2026-08-06T14:41:38.306623Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-08-06T14:41:38.306623Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-08-06T14:41:38.306623Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"first_article","at":"2026-09-16T05:18:06Z","label":"First news coverage","source":"The Hacker News"},{"type":"cisa_reported","at":"2026-09-24T00:00:00Z","label":"Added to CISA KEV catalog","source":"kev"}]}