CISA has added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of a critical (CVSS 10.0) flaw in several WSO2 API management products.
What Is It
The CISA and NVD records describe CVE-2026-5430 in two different ways.
- NVD (CWE-347, Improper Verification of Cryptographic Signature): WSO2's JWT authentication accepts tokens signed with algorithms that were never configured or supported. An attacker can create a JWT with an unsupported algorithm, and the system wrongly accepts it. This gives the attacker unauthorized access, possibly including administrative accounts and full account takeover.
- CISA KEV: CISA lists it as a "Path Traversal Vulnerability" in WSO2 API Control Plane, API Manager, Traffic Manager and Universal Gateway. CISA says it "could allow for unrestricted file upload and lead to remote code execution."
The two sources disagree on the weakness type. Defenders should read the WSO2 advisory (WSO2-2026-5328) for the vendor's own description.
Why It Matters
- Actively exploited: CISA added the flaw to KEV on 2026-09-24. CISA's SSVC assessment rates exploitation as active, automatable as yes, and technical impact as total.
- Severity: The CVSS 3.1 score is 10.0 Critical (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). An attacker needs no authentication and no user interaction. WSO2 lowers the score to 9.8 for single-tenant deployments. - Short deadline: The federal remediation due date is 2026-09-27, three days after the KEV listing.
- Forensic triage required: CISA flags this entry for forensic triage under BOD 26-04.
- Ransomware use: Unknown.
What's Vulnerable
According to NVD, these builds are affected:
| Product | Affected ranges |
|---|---|
| WSO2 API Manager | 4.1.0 < 4.1.0.257; 4.2.0 < 4.2.0.197; 4.3.0 < 4.3.0.108; 4.4.0 < 4.4.0.72; 4.5.0 < 4.5.0.57; 4.6.0 < 4.6.0.21 |
| WSO2 API Control Plane | 4.5.0 < 4.5.0.58; 4.6.0 < 4.6.0.22 |
| WSO2 Universal Gateway | 4.5.0 < 4.5.0.57; 4.6.0 < 4.6.0.21 |
| WSO2 Traffic Manager | 4.5.0 < 4.5.0.56; 4.6.0 < 4.6.0.21 |
- API Manager versions before 4.1.0 are listed with status "unknown."
- The component
org.wso2.carbon.apimgt.rest.api.utilis also listed as affected across several 9.x branches.
Patch Status
The upper bounds of the NVD ranges suggest which builds fix the flaw. For example, the NVD data implies that API Manager 4.6.0.21 and API Control Plane 4.6.0.22 are no longer affected. These fixed versions come from NVD's version ranges, not from vendor confirmation. NVD and CISA also describe the flaw differently, so it is unclear whether these builds fix every issue covered by the KEV entry. Check fixed versions and any extra mitigation steps against WSO2 advisory WSO2-2026-5328 before treating a system as remediated.
CISA's required action says to: - Apply mitigations according to vendor instructions. - Follow BOD 26-04, "Prioritizing Security Updates Based on Risk," and CISA's Forensics Triage Requirements. - Follow BOD 26-04 guidance for cloud services, or stop using the product if mitigations are not available. - Evaluate each asset's internet exposure.
Because CISA requires forensic triage, organizations should check exposed instances for signs of compromise as well as patching them.