SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
5 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-5430 · CVSS 10.0

Several WSO2 products: attackers can read or change files

AFFECTSWSO2 Multiple ProductsWso2 Universal GatewayWso2 Traffic ManagerWso2 API Control PlaneWso2 API ManagerWso2 Carbon API Manager Rest API Utility

OFFICIAL NAME: WSO2 Multiple Products Path Traversal Vulnerability

WHAT IT IS · WEBSITE OR ONLINE STOREIt runs public websites, online stores or the software behind them.

DO THIS FIRSTAsk whoever runs your website or store to update it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 97 days old, so many systems are likely still unpatched. The severity score is critical (10.0).

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. 6 products are affected.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
PROOF OF CONCEPT CLAIMED
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    CVE-2026-5430 discussed publicly (CIRCL sighting). CVE-2026-5430 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. CISA Vulnrichment marks CVE-2026-5430 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-5430 published
  2. EXPLOIT CODE PUBLIC
    CLAIMED
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 49 days after disclosure. CISA listed it 49 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Sep 27, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. AUG 6, 2026
    CISA Vulnrichment marks CVE-2026-5430 as actively exploited
  2. SEP 15, 2026
    4 public GitHub repositories claim a proof of concept for CVE-2026-5430
  3. Attack activity. SEP 23, 2026
    WSO2 Multiple Products Path Traversal Vulnerability
  4. OCT 24, 2026
    CVE-2026-5430 discussed publicly (CIRCL sighting) (6 reports, latest OCT 27)

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-5430 discussed publicly (CIRCL sighting), OCT 27
  2. [2] CISA Known Exploited Vulnerabilities: WSO2 Multiple Products Path Traversal Vulnerability , SEP 23
  3. [3] PoC-in-GitHub: 4 public GitHub repositories claim a proof of concept for CVE-2026-5430, SEP 15
  4. [4] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-5430 as actively exploited, AUG 6
  5. [5] CIRCL Vulnerability-Lookup sightings: 5 more reports