CVE-2026-5430
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
4/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
CISA Known Exploited Vulnerability
Vendor / Product
WSO2 — Multiple Products
Date Added
2026-09-24
Remediation Due
2026-09-27
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/ ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-5430
Weakness Classification (1)
Affected Software (12)
| Vendor | Product | Version |
|---|---|---|
| wso2 | api_control_plane | 4.5.0 – 4.5.0.58 |
| wso2 | api_control_plane | 4.6.0 – 4.6.0.22 |
| wso2 | api_manager | 4.1.0 – 4.1.0.257 |
| wso2 | api_manager | 4.2.0 – 4.2.0.197 |
| wso2 | api_manager | 4.3.0 – 4.3.0.108 |
| wso2 | api_manager | 4.4.0 – 4.4.0.72 |
| wso2 | api_manager | 4.5.0 – 4.5.0.57 |
| wso2 | api_manager | 4.6.0 – 4.6.0.21 |
| wso2 | traffic_manager | 4.5.0 – 4.5.0.56 |
| wso2 | traffic_manager | 4.6.0 – 4.6.0.21 |
| wso2 | universal_gateway | 4.5.0 – 4.5.0.57 |
| wso2 | universal_gateway | 4.6.0 – 4.6.0.21 |
References & Advisories (2)
Vendor Advisory
US Government Resource