CVE-2025-14260
High
Description
Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.
SeverityHigh
CVSS8.3
Exploit probability—
ProductWSO2 API Manager
PublishedOct 28, 2026
First seenNov 4, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- WSO2 WSO2 API Manager3.1.0.354, 3.2.0.458, 3.2.1.99, 4.0.0.379, 4.1.0.265, 4.2.0.205, 4.3.0.115, 4.4.0.79 or later
- WSO2 WSO2 Identity Server as Key Manager5.10.0.374 or later
- WSO2 WSO2 Open Banking AM2.0.0.403 or later
- WSO2 WSO2 Open Banking IAM2.0.0.423 or later
- WSO2 WSO2 Identity Server5.10.0.383, 5.11.0.430, 6.0.0.256, 6.1.0.257, 7.0.0.134 or later
- WSO2 SAML2 SSO Authenticator UI Bundle5.5.0.2, 5.5.2.5, 5.5.9.4, 5.5.10.1, 5.6.4.1, 5.7.2.1, 5.8.3.1, 5.8.7.2, 5.9.4.2 or later
- WSO2 WSO2 Carbon UI4.6.0.2300, 4.6.1.165, 4.6.3.46, 4.6.4.28, 4.7.1.79, 4.8.1.50, 4.9.0.107, 4.9.26.37, 4.9.27.24, 4.10.9.77 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WSO2 WSO2 API Manager | 3.1.0 ≤ v < 3.1.0.354, 3.2.0 ≤ v < 3.2.0.458, 3.2.1 ≤ v < 3.2.1.99, 4.0.0 ≤ v < 4.0.0.379, 4.1.0 ≤ v < 4.1.0.265, 4.2.0 ≤ v < 4.2.0.205, 4.3.0 ≤ v < 4.3.0.115, 4.4.0 ≤ v < 4.4.0.79 | 3.1.0.354, 3.2.0.458, 3.2.1.99, 4.0.0.379, 4.1.0.265, 4.2.0.205, 4.3.0.115, 4.4.0.79 |
| WSO2 WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.374 | 5.10.0.374 |
| WSO2 WSO2 Open Banking AM | 2.0.0 ≤ v < 2.0.0.403 | 2.0.0.403 |
| WSO2 WSO2 Open Banking IAM | 2.0.0 ≤ v < 2.0.0.423 | 2.0.0.423 |
| WSO2 WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.383, 5.11.0 ≤ v < 5.11.0.430, 6.0.0 ≤ v < 6.0.0.256, 6.1.0 ≤ v < 6.1.0.257, 7.0.0 ≤ v < 7.0.0.134 | 5.10.0.383, 5.11.0.430, 6.0.0.256, 6.1.0.257, 7.0.0.134 |
| WSO2 SAML2 SSO Authenticator UI Bundle | 5.5.0 ≤ v < 5.5.0.2, 5.5.2 ≤ v < 5.5.2.5, 5.5.9 ≤ v < 5.5.9.4, 5.5.10 ≤ v < 5.5.10.1, 5.6.4 ≤ v < 5.6.4.1, 5.7.2 ≤ v < 5.7.2.1, 5.8.3 ≤ v < 5.8.3.1, 5.8.7 ≤ v < 5.8.7.2, 5.9.4 ≤ v < 5.9.4.2 | 5.5.0.2, 5.5.2.5, 5.5.9.4, 5.5.10.1, 5.6.4.1, 5.7.2.1, 5.8.3.1, 5.8.7.2, 5.9.4.2 |
| WSO2 WSO2 Carbon UI | 4.6.0 ≤ v < 4.6.0.2300, 4.6.1 ≤ v < 4.6.1.165, 4.6.3 ≤ v < 4.6.3.46, 4.6.4 ≤ v < 4.6.4.28, 4.7.1 ≤ v < 4.7.1.79, 4.8.1 ≤ v < 4.8.1.50, 4.9.0 ≤ v < 4.9.0.107, 4.9.26 ≤ v < 4.9.26.37, 4.9.27 ≤ v < 4.9.27.24, 4.10.9 ≤ v < 4.10.9.77 | 4.6.0.2300, 4.6.1.165, 4.6.3.46, 4.6.4.28, 4.7.1.79, 4.8.1.50, 4.9.0.107, 4.9.26.37, 4.9.27.24, 4.10.9.77 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.