Advisories · Technology

WSO2 Carbon User Manager Kernel.

Every CVE that names WSO2 Carbon User Manager Kernel among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-5617 CVE record

CVSS 4.8 Medium

Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
- WSO2 API Manager
- WSO2 Identity Server
- CWE-799
Not analysed yet 2 Nov 2026
CVE-2024-2323 CVE record

CVSS 4.8 Medium

Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Authentication bypass
Not analysed yet 20 Oct 2026
CVE-2024-4457 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Command injection
Not analysed yet 18 Oct 2026
CVE-2024-6832 CVE record

CVSS 5.9 Medium

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
- WSO2 Enterprise Integrator
- WSO2 API Control Plane
- CWE-693
Not analysed yet 6 Aug 2026
CVE-2024-3511 CVE record

CVSS 4.3 Medium

Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Broken access control
Not analysed yet 23 Jun 2025