Vulnerability details

CVE-2026-3415

WSO2 API Control PlaneWSO2 API ManagerWSO2 Carbon API GatewayWSO2 Carbon API Management ImplementationWSO2 Traffic ManagerWSO2 Universal Gateway

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

CVSS 3.1

8.7High

Official description

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

CVSS scores

Score	Version	Source	Vector
8.7High	3.1	CVEProject cvelistV5 (CNA) (WSO2)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
WSO2	WSO2 API Control Plane	4.5.0 ≤ v < 4.5.0.54	CVEProject cvelistV5 (CNA)
WSO2	WSO2 API Control Plane	4.6.0 ≤ v < 4.6.0.17	CVEProject cvelistV5 (CNA)
WSO2	WSO2 API Manager	v < 3.2.0	CVEProject cvelistV5 (CNA)
WSO2	WSO2 API Manager	3.2.0 ≤ v < 3.2.0.472	CVEProject cvelistV5 (CNA)
WSO2	WSO2 API Manager	3.2.1 ≤ v < 3.2.1.91	CVEProject cvelistV5 (CNA)
WSO2	WSO2 API Manager	4.1.0 ≤ v < 4.1.0.254	CVEProject cvelistV5 (CNA)
WSO2	WSO2 API Manager	4.2.0 ≤ v < 4.2.0.194	CVEProject cvelistV5 (CNA)
WSO2	WSO2 API Manager	4.3.0 ≤ v < 4.3.0.105	CVEProject cvelistV5 (CNA)
WSO2	WSO2 API Manager	4.4.0 ≤ v < 4.4.0.68	CVEProject cvelistV5 (CNA)
WSO2	WSO2 API Manager	4.5.0 ≤ v < 4.5.0.53	CVEProject cvelistV5 (CNA)
WSO2	WSO2 API Manager	4.6.0 ≤ v < 4.6.0.16	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Gateway	6.7.206 ≤ v < 6.7.206.594	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Gateway	6.7.210 ≤ v < 6.7.210.95	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Gateway	9.20.74 ≤ v < 9.20.74.398	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Gateway	9.28.116 ≤ v < 9.28.116.412	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Gateway	9.29.120 ≤ v < 9.29.120.228	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Gateway	9.30.67 ≤ v < 9.30.67.158	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Gateway	9.31.86 ≤ v < 9.31.86.147	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Gateway	9.32.147 ≤ v < 9.32.147.38	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Management Implementation	6.7.206 ≤ v < 6.7.206.594	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Management Implementation	6.7.210 ≤ v < 6.7.210.95	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Management Implementation	9.20.74 ≤ v < 9.20.74.398	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Management Implementation	9.28.116 ≤ v < 9.28.116.412	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Management Implementation	9.29.120 ≤ v < 9.29.120.228	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Management Implementation	9.30.67 ≤ v < 9.30.67.158	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Management Implementation	9.31.86 ≤ v < 9.31.86.147	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Carbon API Management Implementation	9.32.147 ≤ v < 9.32.147.38	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Traffic Manager	4.5.0 ≤ v < 4.5.0.52	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Traffic Manager	4.6.0 ≤ v < 4.6.0.16	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Universal Gateway	4.5.0 ≤ v < 4.5.0.53	CVEProject cvelistV5 (CNA)
WSO2	WSO2 Universal Gateway	4.6.0 ≤ v < 4.6.0.16	CVEProject cvelistV5 (CNA)

References and advisories

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/ vendor-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-08-06
Last updated: 2026-10-28
State: Published
Assigner (CNA): WSO2

Exploit prediction (EPSS)

0.48%

Probability of exploitation in 30 days

42.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-776
Improper Handling of Special Elements in XML Document Type Declaration (DTD)