Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Wso2
Wso2 Enterprise Integrator

WSO2 Enterprise Integrator Vulnerabilities: CVEs, CISA KEV & Security Advisories

20 CVEs

1 in CISA KEV

WSO2 Enterprise Integrator Vulnerabilities

CVE security advisories and vulnerability history for WSO2 Enterprise Integrator by WSO2.

20

Total CVEs

Published

1

In CISA KEV

Exploited in the wild

1

Public exploits

With known exploit

6.5

Avg CVSS

2022–2025

Last updated November 18, 2025

Overview

WSO2 Enterprise Integrator has 20 published CVE records since 2022, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 6.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting WSO2 Enterprise Integrator, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of WSO2 Enterprise Integrator's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical3

High3

Medium14

Low0

In CISA’s Known Exploited Vulnerabilities catalog

1

One of WSO2 Enterprise Integrator's CVEs is confirmed exploited in the wild.

Public exploits

1

One of WSO2 Enterprise Integrator's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every WSO2 Enterprise Integrator version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

6.0.01 CVE
6.1.01 CVE
6.1.11 CVE
6.2.01 CVE
6.3.01 CVE
6.4.01 CVE
6.5.01 CVE
6.6.01 CVE

Fixed in

Find a version

20 CVEs

Sort

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
CVE-2025-6670
Patch
CWE-352
High · CVSS 8.8
EPSS 0.0% (6th pct)2025-11-18
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
CVE-2025-10853
Patch
CWE-79
Medium · CVSS 5.2
EPSS 0.0% (8th pct)2025-11-05
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
CVE-2025-11093
Patch
CWE-94
High · CVSS 8.4
EPSS 0.1% (33th pct)2025-11-05
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
CVE-2025-10907
Patch
CWE-434
High · CVSS 8.4
EPSS 0.5% (67th pct)2025-11-05
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
CVE-2025-10713
Patch
CWE-611
Medium · CVSS 6.5
EPSS 0.1% (24th pct)2025-11-05
Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
CVE-2025-3125
Patch
CWE-434
Medium · CVSS 6.7
EPSS 0.3% (51th pct)2025-11-05
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
CVE-2025-5605
Patch
CWE-290
Medium · CVSS 4.3
EPSS 6.2% (91th pct)2025-10-24
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
CVE-2025-5350
Patch
CWE-918
Medium · CVSS 5.9
EPSS 0.7% (71th pct)2025-10-24
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
CVE-2025-9804
Patch
CWE-284
Critical · CVSS 9.6
EPSS 0.0% (10th pct)2025-10-16
Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration
CVE-2025-9955
Patch
CWE-863
Medium · CVSS 5.7
EPSS 0.0% (6th pct)2025-10-16
Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
CVE-2025-1862
Patch
CWE-434
Medium · CVSS 6.7
EPSS 0.5% (65th pct)2025-09-26
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
CVE-2024-3511
Patch
CWE-863
Medium · CVSS 4.3
EPSS 0.1% (35th pct)2025-06-23
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
CVE-2024-8008
Patch
CWE-79
Medium · CVSS 5.2
EPSS 0.1% (24th pct)2025-06-02
Medium vulnerability · 2025-06-02
CVE-2024-3509
Patch
CWE-79
Medium · CVSS 4.3
EPSS 0.1% (24th pct)2025-06-02
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
CVE-2024-7074
Patch
CWE-434
Medium · CVSS 6.8
EPSS 3.5% (88th pct)2025-06-02
An XML External Entity (XXE) vulnerability in Multiple WSO2 Products
CVE-2025-2905
Patch
CWE-611
Critical · CVSS 9.1
EPSS 0.1% (33th pct)2025-05-05
Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation
CVE-2024-0392
Patch
CWE-352
Medium · CVSS 5.4
EPSS 0.3% (51th pct)2025-02-27
Medium vulnerability · 2023-12-18
CVE-2023-6911
Patch
CWE-79
Medium · CVSS 4.8
EPSS 0.3% (58th pct)2023-12-18
Medium vulnerability · 2023-12-15
CVE-2023-6836
Patch
CWE-611
Medium · CVSS 4.6
EPSS 0.2% (38th pct)2023-12-15
Critical vulnerability · 2022-04-18
CVE-2022-29464
CISA KEV
Public exploit
CWE-22
Added to CISA KEV 2022-04-25
Critical · CVSS 9.3
EPSS 94.4% (100th pct)2022-04-18

Common weakness types

The CWE weakness categories most often found in WSO2 Enterprise Integrator CVEs. Follow any weakness for its full explanation.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type4 CVEs
CWE-611Improper Restriction of XML External Entity Reference3 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-352Cross-Site Request Forgery (CSRF)2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')1 CVE
CWE-284Improper Access Control1 CVE
CWE-290Authentication Bypass by Spoofing1 CVE

Disclosure activity by year

How many WSO2 Enterprise Integrator CVEs were published each year.

2022

1

2023

2

2025

17

Other WSO2 products

Browse vulnerabilities for other products by WSO2.

api manager78 CVEs identity server67 CVEs product-apim56 CVEs WSO2 API Manager45 CVEs WSO2 Identity Server44 CVEs identity server as key manager42 CVEs enterprise integrator32 CVEs WSO2 Identity Server as Key Manager28 CVEs

All WSO2 vulnerabilities

Frequently asked questions

Common questions about WSO2 Enterprise Integrator vulnerabilities.

How many CVEs does WSO2 WSO2 Enterprise Integrator have?

WSO2 WSO2 Enterprise Integrator has 20 published CVE records since 2022.

How many WSO2 WSO2 Enterprise Integrator CVEs are in CISA KEV?

Yes — 1 of WSO2 WSO2 Enterprise Integrator's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for WSO2 WSO2 Enterprise Integrator vulnerabilities?

Yes — 1 of WSO2 WSO2 Enterprise Integrator's CVEs have a known public exploit.

Which versions of WSO2 WSO2 Enterprise Integrator are affected?

45 distinct WSO2 WSO2 Enterprise Integrator versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in WSO2 WSO2 Enterprise Integrator CVEs?

WSO2 WSO2 Enterprise Integrator's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-611 (Improper Restriction of XML External Entity Reference), CWE-863 (Incorrect Authorization).

How many critical WSO2 WSO2 Enterprise Integrator vulnerabilities are there?

WSO2 WSO2 Enterprise Integrator has 3 critical and 3 high-severity CVEs.

What is the average severity of WSO2 WSO2 Enterprise Integrator CVEs?

The average CVSS base score across WSO2 WSO2 Enterprise Integrator's scored CVEs is 6.5.

References

All WSO2 vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track WSO2 Enterprise Integrator vulnerabilities

Monitor new WSO2 Enterprise Integrator vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References