CVE-2026-2613— SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

Quick assessment

Affected

WSO2 WSO2 API Manager

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

管理员 REST API 在未充分清理用户提供的输入的情况下直接接受该输入，导致其被嵌入到 SQL 语句的结构中。拥有管理员权限的用户可利用此漏洞影响所执行 SQL 语句的结构，从而实施盲 SQL 注入，以推断数据库信息，并可能影响数据库服务的可用性。

CVSS 8.7 · High Updated Nov 02, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

Source: CVE Program / CVE List V5

Vulnerability Description

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
WSO2	WSO2 API Manager	4.0.0 ~ 4.0.0.387	-
WSO2	WSO2 Traffic Manager	4.5.0 ~ 4.5.0.50	-
WSO2	WSO2 API Control Plane	4.5.0 ~ 4.5.0.52	-
WSO2	WSO2 Universal Gateway	4.5.0 ~ 4.5.0.51	-
WSO2	WSO2 Carbon API Management Implementation	0 ~ 9.33.25	-

II. Public POCs for CVE-2026-2613

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-2613

请登录查看更多情报信息。

Other References for CVE-2026-2613 (1)

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/ vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-2613

Same Patch Batch · WSO2 · 2026-11-02 · 10 CVEs total

CVE-2025-11969	9.4 CRITICAL	Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized A
CVE-2025-13647	5.8 MEDIUM	Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
CVE-2024-2372	5.4 MEDIUM	Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Atta
CVE-2024-9517	4.9 MEDIUM	Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorize
CVE-2024-5617	4.8 MEDIUM	Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute
CVE-2025-12544	4.8 MEDIUM	Stored Cross-Site Scripting in Multiple WSO2 Products
CVE-2024-7075	4.6 MEDIUM	Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple
CVE-2026-18800	4.4 MEDIUM	Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrie
CVE-2024-12141	4.3 MEDIUM	Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

IV. Related Vulnerabilities

Same product: WSO2 API Manager

Same vendor: WSO2

Same weakness: CWE-89