WSO2 API Manager login bypass is being exploited; CISA sets a 27 September deadline

WSO2 API Manager login bypass is being exploited; CISA sets a 27 September deadline

24 September 2026 — CISA added CVE-2026-5430, a flaw in WSO2 API Manager and related gateway products, to its Known Exploited Vulnerabilities catalogue on 24 September 2026, with a deadline of 27 September for US federal agencies. WSO2's API Manager sits in front of an organisation's internal services and holds the keys and secrets used to reach them, so a compromise reaches much further than the gateway itself.

What the flaw does

WSO2's own advisory, WSO2-2026-5328, rates the flaw critical at 10 out of 10 (9.8 for single-tenant deployments). A token signed with an algorithm the product should not accept is treated as valid, so an attacker can get past authentication and take over an administrator account. CISA's catalogue entry describes it differently, as a path-traversal flaw leading to file upload and code execution. We use WSO2's description here, and note that CISA's label differs.

The security firm watchTowr saw its first confirmed attack against a honeypot on 13 September, SecurityWeek reported on 16 September. An attacker who gets in can reach every backend service behind the gateway, and the consumer keys and secrets of every registered application.

The dates of the fix also differ between sources: SecurityWeek says WSO2 patched in April, while the advisory page says it was published on 3 May 2026. Either way the fix has been available for months.

Who is affected

API Manager 4.1.0 to 4.6.0, and API Control Plane, Traffic Manager and Universal Gateway 4.5.0 and 4.6.0. Fixes ship as WSO2 Updates for subscribers, for example API Manager 4.6.0 update 21 and 4.5.0 update 57; the advisory lists the level for each version. Open-source users need to apply the published fixes or upgrade.

What to do

• Find every WSO2 API Manager, control plane, traffic manager or gateway you run, including ones an integrator runs for you, and check its update level against the advisory.
• Patch first. Then rotate the consumer keys and secrets of registered applications, and the credentials the gateway uses to reach backend services, because attackers had a window from at least 13 September.
• Review administrator accounts and recent configuration changes for anything you cannot explain.
• If a partner or systems integrator runs the gateway, ask it in writing to confirm the update level and the date it was applied.

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog — 24 September 2026
• WSO2 Security Advisory WSO2-2026-5328 / CVE-2026-5430 — 3 May 2026
• SecurityWeek: Enterprises warned of attacks exploiting WSO2 vulnerability — 16 September 2026