WSO2 Traffic Manager vulnerabilities and CVEs

Known vulnerabilities affecting WSO2 Traffic Manager, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

5 vulnerabilities tracked.

9.4 The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute… CVE-2025-11969 2 Nov 2026
8.7 The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL… CVE-2026-2613 2 Nov 2026
4.9 The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. CVE-2024-9517 2 Nov 2026
4.8 When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before… CVE-2025-1397 3 Nov 2026
4.4 When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these… CVE-2026-18800 2 Nov 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that WSO2 Traffic Manager is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

WSO2 Traffic Manager vulnerabilities and CVEs

What this covers

Other products tracked here