Advisories · Technology

WSO2 Identity Server Key Manager Connector (apim-km-wso2is).

Every CVE that names WSO2 Identity Server Key Manager Connector (apim-km-wso2is) among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-4052 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
- WSO2 API Manager
- WSO2 API Control Plane
- Broken access control
Not analysed yet 3 Nov 2026