CVE-2026-3415— XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
Quick assessment
Affected
WSO2 WSO2 API Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WSO2 API Manager是美国WSO2公司开源的一个API管理平台。 WSO2 API Manager、WSO2 Universal Gateway、WSO2 Traffic Manager、WSO2 API Control Plane、WSO2 Carbon API Gateway和WSO2 Carbon API Management Implementation存在资源管理错误漏洞，该漏洞源于XML解析器允许解析外部实体，可能导致高权限攻击者读取服务器文件、发起意外出站请求以及因资源过度消耗造
Possible ATT&CK Techniques 3 AI
T1041 · Exfiltration Over C2 Channel T1059.007 · JavaScript T1210 · Exploitation of Remote ServicesAffected Version Matrix 33
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| WSO2 | WSO2 API Control Plane | 4.5.0< 4.5.0.54 |
affected |
4.6.0< 4.6.0.17 |
affected | ||
| WSO2 | WSO2 API Manager | < 3.2.0 |
unknown |
3.2.0< 3.2.0.472 |
affected | ||
3.2.1< 3.2.1.91 |
affected | ||
4.1.0< 4.1.0.254 |
affected | ||
4.2.0< 4.2.0.194 |
affected | ||
4.3.0< 4.3.0.105 |
affected | ||
4.4.0< 4.4.0.68 |
affected | ||
4.5.0< 4.5.0.53 |
affected | ||
| … +1 more rows | |||
| WSO2 | WSO2 Carbon API Gateway | 6.7.206< 6.7.206.594 |
affected |
6.7.210< 6.7.210.95 |
affected | ||
9.20.74< 9.20.74.398 |
affected | ||
9.28.116< 9.28.116.412 |
affected | ||
9.29.120< 9.29.120.228 |
affected | ||
9.30.67< 9.30.67.158 |
affected | ||
9.31.86< 9.31.86.147 |
affected | ||
9.32.147< 9.32.147.38 |
affected | ||
| … +1 more rows | |||
| WSO2 | WSO2 Carbon API Management Implementation | 6.7.206< 6.7.206.594 |
affected |
6.7.210< 6.7.210.95 |
affected | ||
9.20.74< 9.20.74.398 |
affected | ||
9.28.116< 9.28.116.412 |
affected | ||
9.29.120< 9.29.120.228 |
affected | ||
9.30.67< 9.30.67.158 |
affected | ||
9.31.86< 9.31.86.147 |
affected | ||
9.32.147< 9.32.147.38 |
affected | ||
| … +1 more rows | |||
| WSO2 | WSO2 Traffic Manager | 4.5.0< 4.5.0.52 |
affected |
4.6.0< 4.6.0.16 |
affected | ||
| WSO2 | WSO2 Universal Gateway | 4.5.0< 4.5.0.53 |
affected |
4.6.0< 4.6.0.16 |
affected | ||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-3415
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.
Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
DTD中递归实体索引的不恰当限制(XML实体扩展)
Source: CVE Program / CVE List V5
Vulnerability Title
WSO2 API Manager 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WSO2 API Manager是美国WSO2公司开源的一个API管理平台。 WSO2 API Manager、WSO2 Universal Gateway、WSO2 Traffic Manager、WSO2 API Control Plane、WSO2 Carbon API Gateway和WSO2 Carbon API Management Implementation存在资源管理错误漏洞，该漏洞源于XML解析器允许解析外部实体，可能导致高权限攻击者读取服务器文件、发起意外出站请求以及因资源过度消耗造
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WSO2 | WSO2 API Manager | 3.2.0 ~ 3.2.0.472 | - |
|
| WSO2 | WSO2 Universal Gateway | 4.5.0 ~ 4.5.0.53 | - |
|
| WSO2 | WSO2 Traffic Manager | 4.5.0 ~ 4.5.0.52 | - |
|
| WSO2 | WSO2 API Control Plane | 4.5.0 ~ 4.5.0.54 | - |
|
| WSO2 | WSO2 Carbon API Gateway | 6.7.206 ~ 6.7.206.594 | - |
|
| WSO2 | WSO2 Carbon API Management Implementation | 6.7.206 ~ 6.7.206.594 | - |
|
II. Public POCs for CVE-2026-3415
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-3415
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-3415 (1)
-
🔗 Security Advisory WSO2-2026-5001/CVE-2026-3415 vendor-advisory
Same Patch Batch · WSO2 · 2026-08-06 · 19 CVEs total
| CVE-2026-5430 | 10.0 CRITICAL | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account |
| CVE-2026-1728 | 9.8 CRITICAL | Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account |
| CVE-2025-15039 | 9.4 CRITICAL | Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products |
| CVE-2026-3418 | 9.1 CRITICAL | Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Exe |
| CVE-2025-14561 | 9.0 CRITICAL | Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenan |
| CVE-2024-6541 | 6.8 MEDIUM | Information Disclosure and Integrity Violation via Improper Message Context Handling in Mu |
| CVE-2024-6832 | 5.9 MEDIUM | Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products |
| CVE-2025-13394 | 5.4 MEDIUM | Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables |
| CVE-2025-12317 | 5.0 MEDIUM | Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Acce |
| CVE-2024-8995 | 4.9 MEDIUM | Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthor |
| CVE-2026-0637 | 4.4 MEDIUM | Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products |
| CVE-2025-13909 | 4.3 MEDIUM | Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allow |
| CVE-2025-11850 | 4.3 MEDIUM | Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Ident |
| CVE-2025-6508 | 4.3 MEDIUM | User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows |
| CVE-2024-10302 | 4.0 MEDIUM | Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Man |
| CVE-2025-14779 | 3.8 LOW | Improper Access Control via Secret Type Management API in WSO2 Identity Server |
| CVE-2025-13736 | 3.7 LOW | Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Dis |
| CVE-2025-12627 | 2.4 LOW | Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server |
IV. Related Vulnerabilities
Same product: WSO2 API Manager
-
CVE-2025-5802
Username Enumeration via Self Registration Flow in Multiple -
CVE-2026-3416
Predictable Pseudorandom Number Generation via Webhook HMAC -
CVE-2026-3418
Arbitrary File Upload via System REST API in Multiple WSO2 P -
CVE-2025-14561
Access Control Bypass via Publisher REST APIs in Multiple WS -
CVE-2025-6508
User Interface Misrepresentation via Swagger UI Try-out Cons
Same vendor: WSO2
-
CVE-2025-13166
Username Enumeration via SMS OTP Flow in WSO2 Identity Serve -
CVE-2025-5802
Username Enumeration via Self Registration Flow in Multiple -
CVE-2026-19515
OS Command Injection via Unit Test Execution in WSO2 Integra -
CVE-2026-4103
Cross-Site Scripting via HTML Sanitization in WSO2 Publisher -
CVE-2026-3096
Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 P
Same weakness: CWE-776
-
CVE-2026-92001
Apache Sling XSS: Missing parser resource limits -
CVE-2023-46035
Nando Vieira SvgOptimizer 资源管理错误漏洞 -
CVE-2026-58234
Denial of Service vulnerability in SAP Process Integration ( -
CVE-2026-16180
IBM App Connect Enterprise and IBM Integration Bus for z/OS -
CVE-2026-78681
NLTK before 3.10.3 Entity Expansion DoS via ElementTree
V. Comments for CVE-2026-3415
No comments yet