Wso2 Api Manager — CVE-2026-2053 (Critical)

Date Jun 26, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Wso2 · Api Manager

CVE CVE-2026-2053

Critical vendor advisory CVE-2026-2053

Summary

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from ext

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 8.3) in Wso2 Api Manager. Patch or mitigate promptly. EPSS percentile: 10%.

Operator check

Review CVE-2026-2053 in your asset inventory. Apply patches per vendor guidance and verify Api Manager is not exposed. CVSS score: 8.3. EPSS probability: 0.2%; percentile: 10%.

Sources

NVD — CVE-2026-2053 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed