Skip to content
Critical WSO2 API Manager Vulnerability Under Active Exploitation

Critical WSO2 API Manager Vulnerability Under Active Exploitation

First seen 16 Sep 2026, 08:23 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 17, 2026 at 07:56 UTC
  • •CVE-2026-5430 allows unauthenticated access via forged JWT tokens.
  • •Active exploitation confirmed since September 13, 2026, with critical impact on WSO2 products.
  • •Organizations must update to patched versions immediately to mitigate risks.

A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API Control Plane. The vulnerability was initially patched in April 2026, but exploitation attempts were first observed on September 13, 2026. Attackers can gain unauthorized access to sensitive data and potentially take over administrative accounts. Organizations using affected versions are urged to apply the latest patches immediately. The vulnerability impacts versions 4.1.0 through 4.6.0 of the affected products. WatchTowr reported that the exploitation attempts are ongoing, indicating a significant risk for enterprises relying on WSO2 solutions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 46d ago How this analysis works

Timeline

2026-04-09
CVE-2026-39987 published
A vulnerability in Marimo notebook server was disclosed, allowing remote code execution.
Buttondown
2026-04-23
CVE-2026-39987 added to CISA KEV
CISA included the Marimo vulnerability in its Known Exploited Vulnerabilities catalog.
Buttondown
2026-08-06
CVE-2026-5430 published
WSO2 disclosed a critical vulnerability allowing JWT authentication bypass.
Securityweek
2026-09-13
First exploitation attempts observed
WatchTowr reported active exploitation of CVE-2026-5430 using forged JWT tokens.
Thehackernews
2026-09-15
CVE-2026-89026 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-16
Public PoC for CVE-2026-5430 released
Proof-of-concept code for the WSO2 vulnerability became publicly available, increasing risk.
Buttondown

More articles in this cluster (24)

Following this threat?

Track WSO2 and CVE-2026-39987 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 4