Advisories · Technology

WSO2 Carbon API Manager Rest API Common Functions.

Every CVE that names WSO2 Carbon API Manager Rest API Common Functions among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-11969 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
- WSO2 API Manager
- WSO2 Identity Server as Key Manager
- Broken access control
Not analysed yet 2 Nov 2026
CVE-2026-1728 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
- WSO2 API Manager
- WSO2 API Control Plane
- Privilege escalation
Not analysed yet 6 Aug 2026